SVG Files Abused to Deploy PureMiner Malware and Exfiltrate Data

According to FortiGuard Labs, cybercriminals are using SVG files as an initial attack vector in a multi-stage phishing campaign aimed at Ukrainian government agencies, deploying both cryptocurrency mining malware and information stealers. The operation begins with phishing emails that attach malicious SVGs posing as notices from the National Police of Ukraine, pressuring recipients with legal-sounding language about pending appeals.

The file, elektronni_zapit_NPU.svg, embeds an external SVG resource and, when opened, shows a spoofed Adobe Reader interface in Ukrainian before redirecting victims to download a password‑protected archive. That archive contains a CHM file which loads a malicious HTML file containing a shortcut object that executes a remote HTA resource in hidden mode.

The HTA functions as a CountLoader, sending system information to remote servers and supporting commands for downloads, extractions, DLL execution, domain reconnaissance and cleanup. Dual payload deployment follows: PureMiner, a .NET cryptominer that uses DLL sideloading and AOT compilation to inject into legitimate processes, and Amatera Stealer, delivered via a Python-based loader to harvest data from browsers, wallets and desktop apps, with extensive anti‑analysis techniques.

The campaign underlines evolving phishing tactics and dual revenue streams from mining and data theft, and organisations are urged to tighten email filters and endpoint detection.