{"id":27824,"date":"2025-06-23T14:57:42","date_gmt":"2025-06-23T12:57:42","guid":{"rendered":"https:\/\/perseus.de\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/"},"modified":"2026-03-31T07:22:22","modified_gmt":"2026-03-31T05:22:22","slug":"new-phishing-wave-dangerous-scripts-in-svg-file-attachments","status":"publish","type":"post","link":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/","title":{"rendered":"New Phishing Wave: Dangerous Scripts in SVG File Attachments"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"27824\" class=\"elementor elementor-27824 elementor-23742\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dcf4ec4 e-flex e-con-boxed e-con e-parent\" data-id=\"dcf4ec4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e1db58c elementor-widget elementor-widget-image\" data-id=\"e1db58c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"800\" height=\"200\" src=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\" class=\"attachment-large size-large wp-image-27799\" alt=\"\" srcset=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png 1024w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-300x75.png 300w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-768x192.png 768w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png 1200w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1258a43 e-flex e-con-boxed e-con e-parent\" data-id=\"1258a43\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2de4e88 e-con-full e-flex e-con e-child\" data-id=\"2de4e88\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4982c80 elementor-widget elementor-widget-text-editor\" data-id=\"4982c80\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h6>23.06.2025<\/h6>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8348bc5 elementor-widget elementor-widget-heading\" data-id=\"8348bc5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Dangerous scripts in SVG file attachments\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-eb03842 e-con-full e-flex e-con e-child\" data-id=\"eb03842\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-91d0988 elementor-widget elementor-widget-text-editor\" data-id=\"91d0988\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"79\" data-end=\"370\">Currently, there is an increased threat to IT security from e-mail attachments in <strong data-start=\"160\" data-end=\"174\">SVG format<\/strong>. Security organizations and the Austrian CERT are observing an increase in targeted <strong data-start=\"265\" data-end=\"286\">phishing attacks<\/strong>, in which malicious code is distributed via seemingly harmless vector graphics. <\/p><p data-start=\"372\" data-end=\"514\" data-is-last-node=\"\" data-is-only-node=\"\">The following is background information as well as concrete <strong data-start=\"430\" data-end=\"469\">recommendations for protecting systems<\/strong> from this attack method.<\/p><p>Threat actors target programs like Outlook that have a vulnerability to spy on NTLM credentials. The program is tricked into authenticating itself to a fake server that they control. Once the credentials are exposed, they can be used for malicious purposes.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ceb0f40 e-flex e-con-boxed e-con e-parent\" data-id=\"ceb0f40\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ffbdc12 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"ffbdc12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-02dd0e9 e-flex e-con-boxed e-con e-parent\" data-id=\"02dd0e9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-16d621d e-con-full e-flex e-con e-child\" data-id=\"16d621d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-89904c7 elementor-widget elementor-widget-text-editor\" data-id=\"89904c7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>What happened?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fae461d e-con-full e-flex e-con e-child\" data-id=\"fae461d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0f04793 elementor-widget elementor-widget-text-editor\" data-id=\"0f04793\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Currently, CERT.at and numerous email security vendors are seeing an increase in phishing campaigns that use email attachments in Scalable Vector Graphics (SVG) format. These vector graphics contain embedded JavaScript code that can be executed from the browser when opened. Attackers use this to load fake login pages or install malware \u2013 with the aim of grabbing access data. The affected SVG files often disguise themselves as invoices, voice messages, or documents to be signed.   <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-cdadbd8 e-flex e-con-boxed e-con e-parent\" data-id=\"cdadbd8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-104dd95 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"104dd95\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-174b215 e-flex e-con-boxed e-con e-parent\" data-id=\"174b215\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-e560a6b e-con-full e-flex e-con e-child\" data-id=\"e560a6b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-013b67e elementor-widget elementor-widget-text-editor\" data-id=\"013b67e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Who is affected?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a72ed48 e-con-full e-flex e-con e-child\" data-id=\"a72ed48\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-db8754f elementor-widget elementor-widget-text-editor\" data-id=\"db8754f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Organizations whose email systems do not perform specific checking or filtering for SVG files are particularly at risk. Many security solutions do not recognize these files as dangerous because SVGs are perceived as images. This increases the risk, especially where attachments are opened directly via web browsers or devices.  <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da9fcac e-flex e-con-boxed e-con e-parent\" data-id=\"da9fcac\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-70aad00 e-con-full e-flex e-con e-child\" data-id=\"70aad00\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-55be951 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"55be951\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d3f9227 e-flex e-con-boxed e-con e-parent\" data-id=\"d3f9227\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-6059711 e-con-full e-flex e-con e-child\" data-id=\"6059711\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-26eea72 elementor-widget elementor-widget-text-editor\" data-id=\"26eea72\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>How can I protect myself?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-724b6c6 e-con-full e-flex e-con e-child\" data-id=\"724b6c6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f0c2fb4 elementor-widget elementor-widget-text-editor\" data-id=\"f0c2fb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">To detect and fend off attack attempts at an early stage, you should take the following measures:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Block the receipt of SVG files at the Internet access point\/mail gateway via the MIME type <\/span><span style=\"font-weight: 400;\">image\/svg+xml<\/span><span style=\"font-weight: 400;\"><br><\/span><i><span style=\"font-weight: 400;\">(e.g. in the proxy or firewall; however, can lead to the incorrect display of web pages or emails with legitimate SVG images)<\/span><\/i><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Have SVG files automatically quarantined with embedded scripts<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Ensure (where possible) that your AV and email security solutions detect potentially harmful behavior on SVG files<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sensitize employees specifically to attachments in SVG format and their risks<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Define internal guidelines for dealing with unknown attachments<\/span><b><br><br><\/b><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-65d84f2 e-flex e-con-boxed e-con e-parent\" data-id=\"65d84f2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-3c936a5 e-con-full e-flex e-con e-child\" data-id=\"3c936a5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3bbb54c elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"3bbb54c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-36d5f66 e-flex e-con-boxed e-con e-parent\" data-id=\"36d5f66\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-60eb6a0 elementor-widget elementor-widget-heading\" data-id=\"60eb6a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">What are SVG files anyway?<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-092ac14 elementor-widget elementor-widget-text-editor\" data-id=\"092ac14\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"217\" data-end=\"481\"><strong data-start=\"217\" data-end=\"251\">SVG (Scalable Vector Graphics)<\/strong> is a common file format for <strong data-start=\"289\" data-end=\"307\">vector graphics<\/strong> based on <strong data-start=\"317\" data-end=\"324\">XML<\/strong> . Unlike pixel images (e.g. B. PNG or JPEG), SVG files can be scaled losslessly \u2013 e.g. for logos, icons or diagrams on websites.<\/p><p data-start=\"483\" data-end=\"689\">What many people don&#8217;t know is that SVG files can contain <strong data-start=\"526\" data-end=\"558\">built-in JavaScript code<\/strong> . This makes them \u2013 although actually intended as an image format \u2013 <strong data-start=\"629\" data-end=\"654\">potentially executable<\/strong> and thus susceptible to abuse. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dcff67d e-flex e-con-boxed e-con e-parent\" data-id=\"dcff67d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-ad15629 e-con-full e-flex e-con e-child\" data-id=\"ad15629\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dd3e115 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"dd3e115\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4d0efa2 e-flex e-con-boxed e-con e-parent\" data-id=\"4d0efa2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-33e1a1d e-con-full e-flex e-con e-child\" data-id=\"33e1a1d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ad10fd3 elementor-widget elementor-widget-heading\" data-id=\"ad10fd3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Example: Cyber attack via a manipulated SVG file<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1a494cc e-con-full e-flex e-con e-child\" data-id=\"1a494cc\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3005277 elementor-widget elementor-widget-image\" data-id=\"3005277\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"800\" height=\"498\" src=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/06\/Beispielhafter-Angriff-mit-SVG-Dateien-Website-1024x637.png\" class=\"attachment-large size-large wp-image-27823\" alt=\"\" srcset=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/06\/Beispielhafter-Angriff-mit-SVG-Dateien-Website-1024x637.png 1024w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/06\/Beispielhafter-Angriff-mit-SVG-Dateien-Website-300x187.png 300w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/06\/Beispielhafter-Angriff-mit-SVG-Dateien-Website-768x478.png 768w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/06\/Beispielhafter-Angriff-mit-SVG-Dateien-Website.png 1058w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-10cc462 e-flex e-con-boxed e-con e-parent\" data-id=\"10cc462\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-7451277 e-con-full e-flex e-con e-child\" data-id=\"7451277\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ecf5471 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"ecf5471\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Currently, security organizations and the Austrian CERT are registering an increase in targeted phishing attacks, in which malicious code is injected via seemingly harmless vector graphics.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[64],"tags":[],"class_list":["post-27824","post","type-post","status-publish","format-standard","hentry","category-hazard-warning"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies\" \/>\n<meta property=\"og:description\" content=\"Currently, security organizations and the Austrian CERT are registering an increase in targeted phishing attacks, in which malicious code is injected via seemingly harmless vector graphics.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/\" \/>\n<meta property=\"og:site_name\" content=\"Perseus Technologies\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-23T12:57:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-31T05:22:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Xenia Silbe\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xenia Silbe\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/\"},\"author\":{\"name\":\"Xenia Silbe\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\"},\"headline\":\"New Phishing Wave: Dangerous Scripts in SVG File Attachments\",\"datePublished\":\"2025-06-23T12:57:42+00:00\",\"dateModified\":\"2026-03-31T05:22:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/\"},\"wordCount\":435,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"articleSection\":[\"Hazard warning\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/\",\"name\":\"New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"datePublished\":\"2025-06-23T12:57:42+00:00\",\"dateModified\":\"2026-03-31T05:22:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#primaryimage\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/perseus.de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Phishing Wave: Dangerous Scripts in SVG File Attachments\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"name\":\"perseus-web.de\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/perseus.de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\",\"name\":\"perseus-web.de\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"width\":536,\"height\":172,\"caption\":\"perseus-web.de\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\",\"name\":\"Xenia Silbe\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"caption\":\"Xenia Silbe\"},\"sameAs\":[\"https:\\\/\\\/perseus.de\\\/\"],\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/author\\\/xenia-silbe\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/","og_locale":"en_US","og_type":"article","og_title":"New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies","og_description":"Currently, security organizations and the Austrian CERT are registering an increase in targeted phishing attacks, in which malicious code is injected via seemingly harmless vector graphics.","og_url":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/","og_site_name":"Perseus Technologies","article_published_time":"2025-06-23T12:57:42+00:00","article_modified_time":"2026-03-31T05:22:22+00:00","og_image":[{"width":1200,"height":300,"url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png","type":"image\/png"}],"author":"Xenia Silbe","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Xenia Silbe","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#article","isPartOf":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/"},"author":{"name":"Xenia Silbe","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46"},"headline":"New Phishing Wave: Dangerous Scripts in SVG File Attachments","datePublished":"2025-06-23T12:57:42+00:00","dateModified":"2026-03-31T05:22:22+00:00","mainEntityOfPage":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/"},"wordCount":435,"commentCount":0,"publisher":{"@id":"https:\/\/perseus.de\/#organization"},"image":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","articleSection":["Hazard warning"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/","url":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/","name":"New Phishing Wave: Dangerous Scripts in SVG File Attachments - Perseus Technologies","isPartOf":{"@id":"https:\/\/perseus.de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#primaryimage"},"image":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","datePublished":"2025-06-23T12:57:42+00:00","dateModified":"2026-03-31T05:22:22+00:00","breadcrumb":{"@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#primaryimage","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png"},{"@type":"BreadcrumbList","@id":"https:\/\/perseus.de\/en\/new-phishing-wave-dangerous-scripts-in-svg-file-attachments\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/perseus.de\/"},{"@type":"ListItem","position":2,"name":"New Phishing Wave: Dangerous Scripts in SVG File Attachments"}]},{"@type":"WebSite","@id":"https:\/\/perseus.de\/#website","url":"https:\/\/perseus.de\/","name":"perseus-web.de","description":"","publisher":{"@id":"https:\/\/perseus.de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/perseus.de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/perseus.de\/#organization","name":"perseus-web.de","url":"https:\/\/perseus.de\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","width":536,"height":172,"caption":"perseus-web.de"},"image":{"@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46","name":"Xenia Silbe","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","caption":"Xenia Silbe"},"sameAs":["https:\/\/perseus.de\/"],"url":"https:\/\/perseus.de\/en\/author\/xenia-silbe\/"}]}},"_links":{"self":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/comments?post=27824"}],"version-history":[{"count":1,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27824\/revisions"}],"predecessor-version":[{"id":27825,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27824\/revisions\/27825"}],"wp:attachment":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/media?parent=27824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/categories?post=27824"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/tags?post=27824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}