Talos researchers uncovered a phishing campaign distributing the QBot malware to Windows systems using SVG files.
Talos researchers uncovered a phishing campaign distributing the QBot malware using a new technique that leverages Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
Once a victim receives the email and opens the attachment, their browser decodes and runs the embedded script, which then assembles a malicious payload directly on the victim’s device.
The QBot malware spread via phishing messages, the threat is able to hijack a victim’s email and send itself out as a reply to an existing email thread.
If the recipient enters the password provided by the attacker and opens the zip archive, it can extract an .ISO file. The .iso file allows infecting the victim with the Qakbot malware.
“Since HTML smuggling can bypass traditional network defenses, it is critical to deploy some sort of security protection to the endpoints in your environment. Having robust endpoint protection can prevent execution of potentially obfuscated scripts, and prevent scripts from launching downloaded executable content. Endpoint security can also enforce rules about which executables are trusted to run in your environment.” concludes the report.
(SecurityAffairs – hacking, HTML smuggling)
The post Crooks use HTML smuggling to spread QBot malware via SVG files appeared first on Security Affairs.