VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages

According to VirusTotal, a Google-owned malware scanning service, researchers have flagged a new malware campaign that uses 44 unique Scalable Vector Graphics (SVG) files in phishing attacks spoofing the Colombian judicial system. The SVGs are distributed via email, execute an embedded JavaScript payload, and decode a Base64-encoded HTML phishing page that masquerades as a portal for Fiscalía General de la Nación, with a fake progress bar that triggers the background download of a ZIP archive.

VirusTotal notes that all 44 SVG files remained undetected by antivirus engines due to obfuscation, polymorphism and the inclusion of large amounts of junk code, and that as many as 523 SVG files have been detected in the wild, with the earliest sample dating back to 14 August 2025. The campaign’s technique also involves a Base64-encoded HTML page and a background ZIP download, though the exact nature of the ZIP file was not disclosed.

The report also points to evolving payloads, noting that initial samples were larger—around 25 MB—and have shrunk over time, suggesting attacker adaptation.