Cybersecurity researchers have uncovered a new wave of cyberattacks that weaponize Scalable Vector Graphics (SVG) files, highlighting how even standard web formats are being abused to bypass detection and deliver malicious payloads.

According to VirusTotal, attackers have been distributing phishing emails impersonating the Colombian judicial system. The attachments contained SVG files that executed hidden JavaScript code. Once opened, the code decoded and injected a Base64-encoded HTML phishing page, masquerading as a legitimate portal for Colombia’s Fiscalía General de la Nación (Office of the Attorney General).

The phishing page simulated a government document download process, complete with a fake progress bar, while silently downloading a malicious ZIP archive in the background. Although the nature of the ZIP file has not been fully disclosed, experts warn it likely contained credential stealers or secondary malware.

Investigations revealed 44 unique SVG samples, all of which initially went undetected by antivirus engines. The attackers used obfuscation, polymorphism, and junk code to evade static detection. Retrospective analysis uncovered over 523 related samples, the earliest traced back to August 14, 2025.

“The earliest samples were significantly larger, around 25 MB, shrinking over time as attackers refined their payloads,” VirusTotal noted.

A Broader Trend: macOS Stealers and ClickFix Tactics

The SVG campaign is part of a growing trend of attackers exploiting trusted formats and cracked software downloads to distribute malware. Researchers at Trend Micro flagged the rise of Atomic macOS Stealer (AMOS), which is capable of stealing credentials, browser data, cryptocurrency wallets, VPN profiles, Telegram chats, and files from common macOS folders.

Unlike traditional .dmg infections blocked by Apple’s Gatekeeper protections, attackers have shifted to ClickFix-style tactics. Victims searching for cracked software are redirected to malicious download sites, where they are instructed to execute curl commands in Terminal, bypassing built-in protections and installing AMOS directly.

Similarly, a separate campaign uncovered by CyberArk revealed the StealC malware family, targeting gamers searching for cheats, with over $135,000 siphoned in stolen cryptocurrency assets.

Old Formats, New Tricks: SWF and SVG Abuse

VirusTotal’s new Code Insight tool, which analyzes both legacy (SWF) and modern (SVG) formats, was instrumental in exposing the Colombian phishing campaign. While SWF files (Flash content) still appear in circulation despite Adobe killing Flash in 2020, SVG remains widely used on the web, making it an attractive vector for attackers.

In just the last 30 days, VirusTotal logged 140,803 unique SVG files, of which 1,442 were flagged as malicious — proving how attackers continue to weaponize seemingly harmless web formats.

How We Help Businesses Stay Ahead

At CyberTech Nexus, we specialize in protecting individuals and organizations against these evolving threats. Attacks like the Colombian SVG phishing campaign and macOS stealer infections reinforce the importance of defense-in-depth, a layered security approach that doesn’t rely solely on antivirus or operating system protections.

Here’s how our services map directly to these threats:

• IT & Cybersecurity Consultancy: Tailored strategies to protect against phishing, malware, and insider threats.
• Password & Personal Data Security: Safeguards against credential theft and identity compromise.
• Incident Response & Recovery: Rapid containment and recovery in case of breaches like AMOS or SVG-based attacks.
• Security Audits & Vulnerability Assessments: Detect weaknesses in email systems, endpoints, and cloud environments before attackers exploit them.
• Managed Security Services: Continuous monitoring of suspicious file activity, leveraging threat intelligence like VirusTotal.
• Penetration Testing: Simulated phishing and malware attacks to test resilience against SVG and ClickFix-style campaigns.
• Compliance & Regulatory Services: Ensuring adherence to GDPR, ISO 27001, NDPR, and other frameworks to mitigate legal and financial risks.
• Cyber Protection Academy: Training employees to recognize phishing attempts, malicious file formats, and unsafe downloads.
• Cybersecurity Recruitment Services: Providing skilled SOC analysts and security engineers to strengthen organizational defenses.

Conclusion

The abuse of SVG files, resurgence of malware in legacy formats, and the evolution of macOS stealer campaigns underscore a central truth: attackers innovate constantly. Organizations must match that pace by deploying multi-layered security controls, educating their teams, and partnering with cybersecurity experts.

At CyberTech Nexus, we help businesses and individuals stay a step ahead not just responding to today’s threats but anticipating tomorrow’s.

References:

• VirusTotal Blog – Code Insight on SVG and SWF
• Trend Micro – Atomic macOS Stealer Analysis
• CyberArk – StealC Campaign Findings