VirusTotal finds hidden malware phishing marketing campaign in SVG recordsdata

September 6, 2025

3

VirusTotal finds hidden malware phishing marketing campaign in SVG recordsdata

VirusTotal has found a phishing marketing campaign hidden in SVG recordsdata that create convincing portals impersonating Colombia’s judicial system that ship malware.

VirusTotal detected this marketing campaign after it added assist for SVGs to its AI Code Perception platform.

VirusTotal’s AI Code Perception function analyzes uploaded file samples utilizing machine studying to generate summaries of suspicious or malicious habits discovered within the recordsdata.

After including assist for SVGs, VirusTotal discovered an SVG file that had zero detections by antivirus scans, however whose AI-powered Code Perception function detected utilizing JavaScript to show HTML, impersonating a portal for Colombia’s authorities judiciary system.

**VirusTotal Code insights detecting a malicious SVG file**
*Supply: VirusTotal*

SVG, or Scalable Vector Graphics, is used to generate pictures of strains, shapes, and textual content via textual mathematical formulation within the file.

Nevertheless, menace actors have begun more and more utilizing SVG recordsdata in assaults, as they will also be used to show HTML utilizing the ingredient and execute JavaScript when the graphic is loaded.

Within the marketing campaign found by Virustotal, SVG picture recordsdata are used to render faux portals that show a phony obtain progress bar, finally prompting the consumer to obtain a password-protected zip archive [VirusTotal]. The password for this file is displayed within the faux portal web page.

“As proven within the screenshots under, the faux portal is rendered precisely as described, simulating an official authorities doc obtain course of,” explains VirusTotal.

“The phishing website consists of case numbers, safety tokens, and visible cues to construct belief, all of it crafted inside an SVG file.”

Fake portal for Colombia’s judicial system — **Faux portal for Colombia’s judicial system**
*Supply: VirusTotal*

BleepingComputer discovered that the extracted file incorporates 4 recordsdata: a professional executable from the Comodo Dragon net browser, renamed to be an official judicial doc, a malicious DLL [VirusTotal], and what seems to be two encrypted recordsdata.

**Extracted password-protected archive**
*Supply: BleepingComputer*

If the consumer opens the executable, the malicious DLL might be sideloaded to put in additional malware on the system.

After detecting this preliminary SVG, VirusTotal recognized 523 beforehand uploaded SVG recordsdata that have been a part of the identical marketing campaign however had evaded detection by safety software program.

The addition of SVG assist to AI Code Insights was essential in exposing this specific marketing campaign, as VirusTotal famous that the usage of AI makes it simpler to establish new malicious campaigns.

“That is the place Code Perception helps most: giving context, saving time, and serving to give attention to what actually issues. It isn’t magic, and it will not change skilled evaluation, nevertheless it’s another instrument to chop via the noise and get to the purpose sooner,” concludes VirusTotal.