A large phishing campaign sent tens of thousands of emails with SVG attachments disguised as voicemail notifications. The SVG files hid obfuscated JavaScript that, when opened, rebuilt code and contacted a remote endpoint. Many messages also impersonated “internal” senders and slipped past native spam filtering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email that looks internal: subject says “New voicemail for j.smith” and it’s from your own domain. Feels legit, right? But this two‑month campaign blasted 26,000+ of these. The “voicemail” attachment is actually an SVG file with hidden JavaScript that rebuilds code and calls a remote site, while Microsoft spam scoring says SCL 0 or 1, not spam. Here’s the trick: 95% pretended to be from your own domain, but really came from unknown external senders. The file says voicemail, but the type is SVG or XML, mislabeled as text/plain so scanners think it’s harmless. If you weren’t expecting a voicemail, don’t open the attachment. Report the email in Outlook instead and let security check if that “voicemail SVG” is really a trap.
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
A real campaign targeting people and organizations in Cambodia uses phishing emails with localized “official-looking” themes to trick recipients into running an installer from a compressed file. Once executed, the malware chain deploys Spark RAT for remote control and uses a vulnerable OPSWAT…
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
