Be careful, hackers have found a new technique to trick you with an unexpected attachment format

Cyberattacks are becoming increasingly difficult to detect. Hackers are now using an unexpected file format to evade antiviruses and steal sensitive data. This ingenious but formidable method puts the security of your information at risk.

The phishingor phishingis a method of cyberattack that aims to deceive users for their extract sensitive informationlike passwords or banking data. These attacks, often disguised in legitimate communications, are multiplying through various means. For example, researchers have recently highlighted techniques that use Progressive Web Applications (PWA) on mobile to imitate banking applications, or even RTF files, little used today, which hide sophisticated traps. Today, the hackers innovate again by exploiting an unexpected file format.

This new stratagem is based on files at format SVGa file type usually used for vector graphics. These attachmentsseemingly innocuous, contain code capable of executing malicious scripts. They allow hackers to display fraudulent formsto redirect users to sites de phishing or even download malware.

Hackers exploit SVG files to steal sensitive data

SVG files are different from classic images like JPEG or PNG files. Unlike the latter, they are not made up of pixels, but of lines and shapes described via textual code. This can integrate HTML or JavaScript elements, which makes it a ideal playground for cybercriminals. For example, some hackers have used SVG files to imitate Excel documents with integrated forms. Once filled, they transmit the victims' identifiers directly to the hackers.

Other campaigns have exploited this format to distribute malware. An SVG file might, for example, include a button that tricks the user into downloading a fake document, while running a script to install malware. These files often pass unnoticed by antivirusesbecause they are considered as simple text. To avoid any mishaps, it is advisable to systematically delete any email containing an attachment in this format, unless you are sure of its origin.

Source : Bleeping Computer