{"id":26188,"date":"2026-09-21T15:14:22","date_gmt":"2026-09-21T23:14:22","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/hidden-in-plain-sight-how-svgs-carry-malicious-scripts\/"},"modified":"2026-09-21T15:14:22","modified_gmt":"2026-09-21T23:14:22","slug":"hidden-in-plain-sight-how-svgs-carry-malicious-scripts","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/hidden-in-plain-sight-how-svgs-carry-malicious-scripts\/","title":{"rendered":"Hidden in plain sight: How SVGs carry malicious scripts"},"content":{"rendered":"
\n
\n

In early 2026, sources began reporting an uptick in SVG based malware. SVG, standing for scalable vector graphics, is a filetype usually utilized to create vector images. SVGs are special due to their ability to utilize Javascript. <\/p>\n

Threat actors use this functionality to craft SVG files that can act maliciously. Malicious SVGs can take the form of fake login pages, data exfiltrators, or malicious downloaders, amongst other things. SVGs are frequently overlooked, as they are assumed to be benign images, leaving a gap in security architecture.\u00a0<\/p>\n

SVGs are difficult to detect, can easily be snuck into emails or webpages, and are able to perform malicious and legitimate actions simultaneously. Many security solutions do not account for malicious SVGs, seeing them only as images. Here’s how they work.<\/p>\n

What is an SVG?<\/h2>\n

SVGs are a versatile and widely used image format. Originally proposed in 1994, they became the World Wide Web Consortium\u2019s top choice for an open standard for web-based vectors in 1999, and started being mass adopted around the 2010s. Vector images scale without compression artifacts, looking good no matter the size, making them useful in a variety of situations. <\/p>\n

They rely on writing out formulas to generate the images, as opposed to mapping specific colored pixels to specific areas (bitmap), like PNGs or JPEGs do. They keep their text embedded within them<\/span><\/a>, allowing for the contents to be searchable, aiding in search engine optimization<\/span><\/a>, or for image creators to include descriptions and comments. They\u2019re written in XML, creating unique opportunities for interaction with certain applications. There are many programs that can be used to generate these files<\/span><\/a>, and there is also the possibility to hand write them if one understands the syntax.\u00a0<\/p>\n

Due to the XML based nature of SVGs, it is possible to embed Javascript with SVG files. On paper, the intended use of this feature would be to foster interactive assets or create animation, although more elaborate functions are possible. Unfortunately, Javascript is being used by malware authors to turn these seemingly harmless files into weapons. Most do not consider images when they\u2019re thinking about malicious filetypes, but they can be used for various attacks. In most browsers, embedded Javascript will execute as a default<\/span><\/a>, leaving unaware users and organizations vulnerable.\u00a0<\/p>\n

Malicious SVGs can be categorized into three different kinds of attack<\/span><\/a>: Redirector, self-contained phishing, and DOM injection\/script abuse. Redirectors are the most simple, and are SVGs used to redirect users to a different site where the actual compromise takes place. Sometimes, users click an image they can\u2019t even see to be redirected. Other times, users may be encouraged to click the image, opting into the redirect more overtly. <\/p>\n

The secondary site may contain a malicious payload or be a phishing site. The secondary type of SVG attack is self-contained phishing pages. These will use SVG\u2019s HTML, CSS and Javascript capabilities to create phishing pages and extract credentials. Finally, the scripts in SVGs can very directly cause harm. DOM abuse leads to cross-site scripting (XSS) effects, or the Javascript itself executes malicious commands.\u00a0<\/p>\n

While they seem like an unusual vector, SVGs have the advantage of being difficult to detect. They can easily be snuck into emails or webpages, and are able to perform malicious and legitimate actions simultaneously. Many security solutions do not account for malicious SVGs, seeing them only as images.<\/p>\n

Examples from the wild<\/h2>\n

Recently, ReversingLabs examined a pool of recent, malicious SVG files. Multiple trends were observed, showing off facets of the aforementioned attack types. The following covers descriptions of these kinds of attacks, to show how they work in practice.<\/p>\n

Self-contained script abuse website<\/h3>\n

This is an example of an SVG that acts as a website, including external links and a surprise Javascript payload to execute. There are multiple variations on this website, with content in a variety of languages, but the sites remain similar. The SVG encodes the entire webpage, and keeps the formatting consistent throughout. All webpages report to have the same company behind them, write extensively about online gambling, and even a link to the same personal photography blog. The website has a search function which does send the inputs to a server, but the webpage does not seem to change or redirect from its use. <\/p>\n

\n