SVG Smuggling: Fake Colombian Judicial Lure Deploys AsyncRAT via Malicious HTA File

On 14 October 2025, Seqrite Threat Research Labs uncovered a targeted Spanish-language phishing campaign aimed at Colombian users, using malicious SVG attachments to deploy AsyncRAT, a remote access Trojan capable of espionage and data theft.

The campaign impersonates Colombia’s judicial system, specifically referencing “Juzgado 17 Civil Municipal del Circuito de Bogotá,” to persuade victims to open the attachment named “Fiscalia General De La Nacion Juzgado Civil 17[.]svg.” The SVG file hides JavaScript that leads to a malicious HTA file, which in turn downloads a Visual Basic dropper (actualiza.vbs) and a PowerShell downloader (veooZ.ps1) that retrieves a .NET loader (ClassLibrary3.dll).

The loader injects AsyncRAT into MSBuild.exe, with anti‑analysis and anti‑virtualisation checks to evade detection, and persistence is achieved via PowerShell registry entries or startup folder shortcuts. According to Seqrite Threat Research Labs, the campaign leverages SVG, HTA, VBS, and PowerShell stages to download and decode the loader and execute AsyncRAT, providing full remote access for data theft and surveillance. Seqrite warns that SVG-based malware poses a rising threat vector, noting that SVGs can remain undetected by many traditional security solutions.