SVG attachment phishing: how an image file can steal your password

An SVG file looks like an image to most people and to many filters. In a browser, it behaves more like a web page: it can run JavaScript, redirect you and draw a fake sign-in form. This guide explains what makes SVG attachments dangerous, what recent campaigns looked like, how to check a suspicious file safely, and how to hold SVG attachments before anyone opens them. For the wider family of web-file attacks, see HTML attachment phishing and HTML smuggling.

What is SVG attachment phishing?

SVG attachment phishing is an attack where the email carries an .svg file that, when opened, sends the reader to a phishing page or shows one. SVG (Scalable Vector Graphics) is a standard image format for logos, icons and charts. Unlike a JPEG or PNG, an SVG file is plain text written in XML, the same family of markup as HTML.

Microsoft summed up the attraction in a September 2025 analysis: SVG files "are attractive to attackers because they are text-based and scriptable," which allows them "to embed JavaScript and other dynamic content directly within the file."

The lure is the same one used with HTML attachments: an invoice, a remittance advice, a shared document, a voicemail or a signing request. The difference is the file type, which many people, and some filters, still treat as a harmless picture.

Why can an image file run code?

An SVG file can run code because the SVG standard includes scripting. The W3C's SVG 2 specification defines a script element that it calls "equivalent to the 'script' element in HTML", and event attributes whose names start with "on", such as onload. SVG also supports hyperlinks through the a element.

Whether that script runs depends on how the file is opened. MDN's guide to SVG as an image explains that when an SVG is used as an image, for example in an HTML img tag or a CSS background, browsers may apply security restrictions: "JavaScript is disabled" and external resources can't be loaded. MDN adds that those restrictions "don't apply when SVG content is viewed directly."

An email attachment is viewed directly. Double-click it and it may open in a web browser as its own document, where those image restrictions don't apply.

What's inside a malicious SVG?

Here's a simplified, defanged example of the kind of code a phishing SVG contains. It is for illustration only; the address is not real.

<svg xmlns="http://www.w3.org/2000/svg" width="600" height="400">
  <rect width="600" height="400" fill="#ffffff"/>
  <text x="40" y="60">Loading secure document...</text>
  <script>
    // The real address is usually hidden with encoding or obfuscation
    window.location.href = "hxxps://login-check.example/?u=jane@example.com";
  </script>
</svg>

Real samples hide the address. In the September 2025 campaign, Microsoft found the SVG showed an invisible fake "Business Performance Dashboard". Business words such as revenue, operations and risk were packed into a hidden attribute, and embedded JavaScript decoded them back into code that redirected the browser, fingerprinted it and tracked the session.

What does a real SVG phishing campaign look like?

Real SVG campaigns use a document-themed email, an SVG named to look like a PDF or document, and a chain that runs from a CAPTCHA to a fake sign-in page. Two documented examples show the pattern.

August 2025. Microsoft detected a campaign on August 18, 2025, mainly aimed at US-based organizations. It was sent from a compromised small business email account. The sender and recipient addresses were the same, with the real targets hidden in BCC. The email looked like a file-sharing notice, and the attachment was named 23mb – PDF- 6 pages.svg. Opening it led to a "security verification" prompt, a social engineering step meant to build trust.

February 2026. Microsoft's Q1 2026 email threat report describes a campaign on February 23 to 25 that sent more than 1.2 million messages to over 53,000 organizations in 23 countries. Each email carried an SVG named to match its theme, and the file names included a Base64-encoded copy of the recipient's email address. Users saw a "security check" CAPTCHA, then a fake sign-in page.

How common is it?

SVG volume rises and falls with specific phishing kits. According to Microsoft's reports:

• SVG grew 49% in February 2026 among CAPTCHA-gated phishing campaigns that month, according to Microsoft, then fell 57% in March.
• In the Q2 2026 report, SVG's share of malicious payloads had fallen from a peak of 23% in July 2025 to about 7%.
• SVG's share of CAPTCHA-gated phishing hit 5% in April 2026, then rose to 12% in May and 26% in June. Microsoft said the recovery "bears monitoring."

The lesson for admins: don't relax an SVG rule because the trend dipped for a quarter.

How can you tell if an SVG attachment is malicious?

You can usually tell from context before you look at any code: real invoices, contracts and voicemails don't arrive as SVG images. Treat these as red flags:

• A document that isn't a document. Names like Invoice.pdf.svg, Remittance_Advice.svg or Voicemail_00-42.svg. Turn on file extensions in Windows so you can see the real ending.
• Your own address in the file name. A name such as Statement_amFuZUBleGFtcGxlLmNvbQ==.svg contains jane@example.com in Base64, a sign the file was generated for you.
• Self-addressed email. The message is "from" and "to" the same address and you were a hidden BCC recipient.
• A CAPTCHA or "security check" after opening. Real documents don't ask you to prove you're human.
• A sign-in page after opening an image. A picture never needs your password.

How to inspect an SVG safely

If you or IT need to confirm what a file does, follow these steps on a work computer you're allowed to use for this:

1. Don't double-click it. Save the attachment to a folder without opening it, or ask IT to pull it from quarantine.
2. Open it in a plain text editor, such as Notepad on Windows or TextEdit in plain-text mode on a Mac. The code shows as text and nothing runs.
3. Search for <script. A logo or chart rarely needs script.
4. Search for on attributes, such as onload= or onclick=, which run code when something happens.
5. Look for <foreignObject>, <a href or window.location, which can embed HTML forms or send the browser elsewhere.
6. Look for long strings of random-looking letters, or functions such as atob, which decodes Base64. That usually means hidden content.
7. Check the email itself with the Email Header Analyzer to see where it came from and whether it passed SPF, DKIM and DMARC. The August 2025 campaign used a real compromised mailbox, so a pass doesn't make the file safe.

If any of steps 3 to 6 find something, report the message and delete the file.

How do I block or quarantine SVG attachments?

Quarantine inbound SVG attachments from outside your organization at the gateway, and release the rare expected one after a check. That holds the file before anyone can open it, which works even when the script is obfuscated differently for every recipient.

In Microsoft 365

Use the common attachments filter in an anti-malware policy (Microsoft Learn). At the time of writing (October 2026):

• svg is not in the default list or in the list of additional file types you can select, but the Defender portal lets you "add your own values".
• svg isn't on the true type matching list either, so the filter falls back to simple extension matching for it.
• The default action is Reject the message with a non-delivery report (NDR). Choose Quarantine the message if you want admins to be able to release a genuine file.

Add svg alongside the HTML-family types covered in our HTML attachment guide.

In Google Workspace

In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Safety and scroll to Attachments (Google Workspace Admin Help). Protect against attachment with scripts from untrusted senders and Protect against anomalous attachment types in emails both default to Keep email in inbox and show warning; change them to Quarantine to hold the message. For an explicit SVG rule, use an attachment compliance rule that matches the file type, as described in our Google Workspace content compliance guide.

At a filtering gateway

If your MX records point to a filtering service, add .svg to its attachment-type rules so the message is held before it reaches Microsoft 365, Google Workspace or your own server. Our list of dangerous email attachment types covers the other file types worth holding at the same time.

What should you do if you opened an SVG attachment?

If you opened a suspicious SVG and nothing else happened, close the browser tab, report the email and tell IT. In the documented campaigns, opening the file started a redirect rather than installing anything, but the page may have recorded your email address and browser details.

If you typed a password or approved a sign-in after opening it:

1. Change that password immediately from a device you trust, and anywhere you reuse it.
2. Tell IT so they can sign you out of all sessions and check for new inbox rules or forwarding.
3. Follow what to do after clicking a phishing link for the full recovery steps.

Next steps

• Check your anti-malware or attachment policy today and add svg as a quarantined file type.
• Search your message trace or quarantine for .svg attachments from the last month to see who receives them and from where.
• Add "documents that arrive as images" to your security awareness training, with a defanged example like the one above.
• Run a free Email Health Check on your domain. iBlockSpam's attachment-type filters can hold SVG files at the MX level, with a personal quarantine for every user; see how it works.

Browse our other phishing and threat guides.