Microsoft blocks AI-driven credential phishing hidden in SVG payload

Microsoft threat researchers said they detected and blocked a credential phishing campaign on August 18 that used artificial intelligence aided techniques to hide malicious code inside what appeared to be a PDF attachment. The campaign, which targeted organizations in the United States, used a compromised small business email account to send self-addressed messages with real recipients hidden in the Bcc field and an attached file named "23mb PDF 6 pages.svg" that actually contained executable content.

The attached SVG file exploited the graphic format's ability to include embedded scripts and dynamic content. Rather than using conventional encryption or random encoding, attackers disguised their payload as a business performance dashboard, inserting invisible chart elements and encoding malicious instructions as a long string of business-related words such as revenue, operations and risk. Embedded JavaScript decoded those terms into executable instructions that could fingerprint a browser, track a session and, under the right conditions, redirect a user to a fake CAPTCHA page and then to a fraudulent sign-in form designed to harvest credentials.