Hackers never stop looking for ways to steal data from your business. Now, they’ve turned their attention to leveraging SVG files, a type you would never suspect. These seemingly harmless image files are the source of a recent spate of SVG phishing attacks to bamboozle people into sharing their Office 365 login credentials. If your inbox isn’t a battlefield, this is another reason to stay vigilant.
What You Should Know About SVG-Based Phishing Threats
Unless you work in graphic design or web development, you might not be familiar with SVG (Scalable Vector Graphics) files. They’re commonly used for logos, illustrations, and designs because they maintain quality when resized. What makes them unique is that they’re built using XML text instructions, which hackers have figured out how to exploit.
Here’s how an attack exploiting SVG file security vulnerabilities works:
- A cybercriminal sends an email with an SVG file attached, often disguised as an invoice or important document.
- If someone in your company opens the file in a web browser, hidden malicious code automatically runs in the background.
- A fake Office 365 login page opens, asking for login credentials, which go directly to the hackers who use them to access the company network and do more damage.
Because SVG files aren’t as commonly flagged as suspicious, these attacks can easily slip past email security filters, which is why they’re so dangerous.
Three Tips for Protecting Against SVG Malware and Phishing Attempts
Awareness of the cybersecurity risks with SVG files is the first step in keeping your data safe. Here’s what you can do to prevent falling victim to these attacks:
- Train Your Team
Make sure everyone knows about the threat of phishing scams using SVG files. Reinforce the golden rule: Never open attachments from unknown senders—especially SVG files. Since SVGs are meant for graphics, most employees shouldn’t need to open them.
- Change How SVG Files Open
Suppose anyone in your company does need to use SVGs. In that case, you can reduce the risk by setting their computer to always open SVG files in Notepad instead of a browser. This prevents them from executing malicious code. To do this:
- Open a known, safe SVG file on a Windows computer.
- Select Notepad as the default program.
- Check the box to always use this program for SVG files.
This simple step ensures that SVG files are only opened as text files, preventing automatic redirections to phishing sites when malicious SVG attachments land in the inbox.
- Strengthen Email Security
Update your email security software to detect and block suspicious SVG files. Many security programs now recognize SVG phishing attempts, but regular updates are essential to prepare for evolving threats.
Stay One Step Ahead
Cybercriminals are constantly seeking new ways to thwart cybersecurity measures, and SVG phishing attacks are just the latest trick in their playbook. Keep your team informed about new concerns and take steps to keep your business—and your data—safe from these evolving threats.
