Hidden in Plain Sight: How SVGs Carry Malicious Scripts

    Thursday, July 23, 2026 In: Threat Research Print

    Date: 07/23/2026

    Severity: High

    Summary

    SVG (Scalable Vector Graphics) files can embed JavaScript and other active content, making them an effective vehicle for phishing, malware delivery, and browser-based attacks while appearing to be harmless images. Attackers abuse SVGs by hiding obfuscated scripts, redirects, and credential-stealing logic, allowing them to evade traditional security controls that treat SVGs as image files. The research recommends inspecting SVGs as executable content, detecting embedded scripts and suspicious JavaScript, and strengthening email and web filtering to identify weaponized SVG attachments. 

    Indicators of Compromise (IOC) List

    Domain/Urls

    01058telecom.de

    qedhsp.cprltdf.es

    wihportal.sbs

    Hash

    0d289ae3837acc7d076b770b6cec2a1d8b0fabf0

    177122bdcc5dc1ddd38a01c68b4b7c627c7a50b0

    2b081fb89d88c93ee5339d33eb3200b69d5f3b8b

    2b48a6c9cfb3932021c7c4b567199f57802ad018

    31652250f9e4f67579a3e187806ba2cfad1792db

    3734b0314f01293b36efb9fbff133a332ab9d6b0

    5fa626b691613abbcc0eed2d143c3a485853d8d9

    771151e26a5e7d3198d3b28a919e802965482d39

    7d4daac63543a754ee43cfc4e812040e6ed32ac9

    806d8283de91c116f2c56ad0aa4c7ae0b33de626

    955dbf23d53832f5f1c514b116a5cc04ccc635ec

    97f5bfb2f8c2aa240d52345c54ef2e99b760c16e

    997ca1f4d9e94293ddaed0a63968fd25c19e8a6c

    bf978f20fd2320645bda61a78ef7d652130394a1

    c5329cfae6d94b2ba9dddaa20b1725a51104581c

    cb53af4fbf24936590f5092f717661d3579d50de

    d632cad92dd560374eef427930cbef562b309067

    d9e4ae7bf23b5c6691156a6fa7fb128ea6890584

    df9582a020b87af2ab67aeeb9cd48e63a1c7fa3e

    e01739c067950beb1a877b54401ae2a47962b61c

    eec21fc0c0163117039b1cc2a9209ade788f4d64

    effcc8433a07fb9e1b1cc2efa621487d62315177

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "qedhsp.cprltdf.es" or url like "qedhsp.cprltdf.es" or siteurl like "qedhsp.cprltdf.es" or domainname like "wihportal.sbs" or url like "wihportal.sbs" or siteurl like "wihportal.sbs" or domainname like "01058telecom.de" or url like "01058telecom.de" or siteurl like "01058telecom.de"

    Detection Query 2 :

    sha1hash IN ("3734b0314f01293b36efb9fbff133a332ab9d6b0","2b48a6c9cfb3932021c7c4b567199f57802ad018","eec21fc0c0163117039b1cc2a9209ade788f4d64","effcc8433a07fb9e1b1cc2efa621487d62315177","806d8283de91c116f2c56ad0aa4c7ae0b33de626","31652250f9e4f67579a3e187806ba2cfad1792db","955dbf23d53832f5f1c514b116a5cc04ccc635ec","df9582a020b87af2ab67aeeb9cd48e63a1c7fa3e","5fa626b691613abbcc0eed2d143c3a485853d8d9","c5329cfae6d94b2ba9dddaa20b1725a51104581c","cb53af4fbf24936590f5092f717661d3579d50de","97f5bfb2f8c2aa240d52345c54ef2e99b760c16e","d9e4ae7bf23b5c6691156a6fa7fb128ea6890584","0d289ae3837acc7d076b770b6cec2a1d8b0fabf0","177122bdcc5dc1ddd38a01c68b4b7c627c7a50b0","7d4daac63543a754ee43cfc4e812040e6ed32ac9","d632cad92dd560374eef427930cbef562b309067","771151e26a5e7d3198d3b28a919e802965482d39","bf978f20fd2320645bda61a78ef7d652130394a1","997ca1f4d9e94293ddaed0a63968fd25c19e8a6c","2b081fb89d88c93ee5339d33eb3200b69d5f3b8b","e01739c067950beb1a877b54401ae2a47962b61c")

    Reference: 

    https://www.reversinglabs.com/blog/how-svgs-carry-dangerous-scripts 


    Tags

    MalwareSVGPhishingObfuscationCredential Harvesting

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.