Colombian Malware Exploits SWF and SVG to Evade Detection

A sophisticated malware campaign targeting Colombian institutions uses weaponized SWF and SVG files to evade detection, as reported by GBHackers on 5 September 2025. The discovery emerged via VirusTotal’s newly enhanced Code Insight platform, which added support for analysing these vector-based formats as attackers impersonate the Colombian justice system.

VirusTotal processing shows 47,812 unique SWF files in the past month, with 466 flagged as malicious by at least one antivirus engine, while 140,803 unique SVG files were received last month, of which 1,442 exhibited malicious behavior. The SVG threat operates through a coordinated phishing campaign targeting Colombian citizens with fake government portals, deploying a multi-stage attack that decodes a base64 HTML phishing page and then downloads a second payload—a malicious ZIP archive—behind the scenes.

Researchers noted 44 additional unique SVG files undetected by traditional antivirus solutions but detectable through behavioural analysis, with samples dating back to August 2025 and first samples around 25MB in size. The campaign showcases polymorphism and substantial dummy code to raise file entropy and defeat static detection, underscoring a broader shift toward non-executable file formats in cyber threats.