Dark Caracal Phishes Tax Lures With SVG Files

Researchers linked a June 2026 intrusion at a communications organization in Venezuela to the Dark Caracal espionage group. The attackers used phishing emails with financial/tax-themed lures and weaponized SVG attachments that redirected victims through URL shorteners to an attacker site hosting malware.

Key findings

• June 2026 intrusion at a communications organization in Venezuela was assessed (medium confidence) as linked to Dark Caracal.
• Delivery used phishing emails with financial/tax lures and weaponized SVG attachments, which redirected through URL shorteners to attacker-controlled infrastructure.
• Opening the SVG led to a shortened URL, then a redirector, then an attacker site (getpdfdigital[.]cloud) that delivered a 7-Zip archive with a Go-based implant.
• Malware chain included a lightweight GoCaracal implant that later pulled additional payloads including an updated Bandook backdoor and a more capable GoCaracal build.
• The extended GoCaracal build included an Ethereum smart-contract fallback to obtain replacement C2 addresses if primary C2 failed.

Who’s being targeted

• Commonly targeted roles: Finance, Accounting/Tax, Executive assistants, All employees (phishing awareness).
• Affected industries: Telecommunications, Government, Journalism/Media, Businesses, Activists/Non-profits.
• Attack channels: email, website.
• Impersonated: Unspecified sender posing as a finance/tax-related contact.

Awareness takeaways

• Treat unexpected financial/tax emails, especially with unusual attachments like SVG, as suspicious and verify the request through a trusted channel.
• Be wary of attachments that push you to click a shortened link or redirect to download a file; this is a common way attackers hide their true destination.
• If a “document” download arrives as a compressed archive (e.g., 7-Zip), stop and report it, this is a strong sign of malware delivery.

Red flags to watch for

• Unexpected SVG attachment for a financial/tax document
• Attachment triggers a browser redirect via a URL shortener/redirector
• Download arrives as a compressed archive (7-Zip) instead of a normal PDF/document