Fake Voicemail SVGs Bypass Email Defenses

A large phishing campaign sent tens of thousands of emails with SVG attachments disguised as voicemail notifications. The SVG files hid obfuscated JavaScript that, when opened, rebuilt code and contacted a remote endpoint. Many messages also impersonated “internal” senders and slipped past native spam filtering.

Key findings

• Two-month campaign (June 1–August 4, 2026) delivered 26,589 phishing emails across 5,527 organizations.
• Lure was an “internal voicemail notification,” with subjects personalized using the recipient’s email local-part.
• SVG attachments contained obfuscated JavaScript and fetched a remote endpoint after runtime reconstruction/deferred execution.
• Attachments were labeled with a misleading MIME type (text/plain) to evade scanners that trust declared content type.
• 95% of messages “claimed to come from the recipient's own domain” (internal impersonation), while actually coming from an external sender.
• Microsoft native spam scoring rated most of the messages as not spam (SCL 0–1 for 75% of messages).

Who’s being targeted

• Commonly targeted roles: All employees, IT / Email administrators, Security awareness team, Helpdesk / Service desk.
• Affected industries: Cross-industry (multiple organizations targeted).
• Attack channels: email, website.
• Impersonated: Internal sender from the recipient’s own domain (spoofed), Internal voicemail system notification.

Awareness takeaways

• Treat unexpected voicemail emails with attachments as suspicious, especially if you weren’t expecting a voicemail.
• Be cautious of messages that look internal (your own domain) but may be spoofed, verify the sender through trusted channels if unsure.
• Don’t assume an attachment is safe because it looks like an image or is labeled as plain text, attackers can hide scripts in SVG files.
• Native spam filters can miss large campaigns; employees should still follow reporting procedures even when messages aren’t marked as spam.

Red flags to watch for

• Unexpected voicemail attachment delivered by email
• Sender appears internal but actually comes from an external, unauthenticated source
• Attachment is an SVG/XML file masquerading as a voicemail
• File type mismatch (voicemail-themed name but SVG/XML content)
• Attachment is treated as harmless text due to MIME mislabeling
• Hidden script behavior (deferred execution / runtime injection)