New SVG-based phishing campaign is a recipe for disaster

Malwarebytes reports a new SVG-based phishing campaign that proves to be a recipe for disaster, with several SVG files dating back to 26 August 2025 used in targeted attacks. The article explains that SVGs, written in XML, can contain HTML and JavaScript, enabling malicious activity, and that Windows tends to open SVGs in Edge, potentially bypassing protections tied to other browsers.

In the analysed sample inside RECElPT[.]SVG, a script uses food- and recipe-related names to disguise its true purpose, with a decoder that splits a data-ingredients string, extracts leading numbers, subtracts 100, and converts ASCII values to characters before redirecting to window.location[.]replace("https://outuer.devconptytld[.]com.au/"). The redirected page then forwards the user to a second location, where a fake login form—likely Microsoft 365 or Outlook-themed—could capture credentials.

Some remarks note a TLS certificate dating back to 24 August 2025, valid for three months, and that the phishing domain may be a typosquat for devconptyltd.com[.]au, with several subdomains involved; Microsoft flagged a similar AI-obfuscated campaign. According to Microsoft, and as shown by the load of clues like “141 cups of eggs,” the threat is both targeted and sophisticated.