Loading story…
Microsoft Threat Intelligence identified a sophisticated phishing campaign targeting U.S.-based organizations, leveraging artificial intelligence to craft highly convincing and evasive attacks. The campaign was detected in late August 2025 and involved the use of compromised small business email accounts to distribute phishing emails. These emails masqueraded as legitimate file-sharing notifications, enticing recipients to open an attachment that appeared to be a PDF but was actually a Scalable Vector Graphics (SVG) file. The attackers exploited the SVG format's flexibility, embedding dynamic and interactive code that could bypass many traditional security tools. Instead of using standard obfuscation techniques, the malicious payload was hidden within the SVG file by encoding it with a sequence of business-related terms, such as 'revenue,' 'operations,' and 'risk,' making the file appear as standard business data. This approach allowed the attackers to disguise the true intent of the file, which was to redirect users to a fake sign-in page designed to harvest credentials. Microsoft noted that the code within the SVG was likely generated or enhanced using large language models (LLMs), a form of AI that can produce complex, human-like text and code, further complicating detection efforts. The phishing emails also employed a self-addressed tactic, where the sender and recipient addresses matched, with actual targets hidden in the BCC field to evade basic detection heuristics. SVG files are particularly attractive to attackers because they are text-based, scriptable, and support features like invisible elements, encoded attributes, and delayed script execution, all of which can be used to sidestep static analysis and security scanning. Microsoft responded by using its own AI-powered security tools to analyze and block the campaign, highlighting the growing trend of AI versus AI in cybersecurity defense and offense. The campaign underscores the increasing adoption of AI by threat actors to automate the creation of convincing phishing lures and obfuscated malware. The use of compromised business email accounts added legitimacy to the phishing attempts, increasing the likelihood of successful credential theft. The incident demonstrates the evolving threat landscape, where attackers continuously adapt their methods to outpace security defenses. Organizations are advised to enhance their email security protocols, educate users about the risks of unexpected file attachments, and deploy advanced detection tools capable of analyzing complex file formats like SVG. The campaign serves as a warning that traditional security measures may be insufficient against AI-driven threats, necessitating a proactive and adaptive security posture. Microsoft’s public disclosure of the attack provides valuable intelligence for defenders to recognize and mitigate similar threats in the future. The incident also highlights the importance of monitoring for unusual email behaviors, such as self-addressed messages and unexpected file types. As AI becomes more accessible to both attackers and defenders, the arms race in cybersecurity is expected to intensify, with increasingly sophisticated attacks targeting organizations of all sizes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In related reporting, Forcepoint described a separate multi-stage phishing attack using .XLAM attachments to deploy XWorm RAT, while Cofense observed phishing lures themed around the U.S. Social Security Administration and copyright infringement delivering other malware. These findings were presented as part of a broader rise in sophisticated phishing tradecraft.
Microsoft said it successfully blocked the observed campaign and warned that similar AI-assisted obfuscation and delivery techniques are increasingly being adopted by threat actors. The disclosure highlighted the use of self-addressed emails and BCC recipient hiding to evade detection.
Microsoft uncovered a limited phishing campaign aimed at U.S. organizations in which attackers used compromised business email accounts and SVG attachments that redirected victims to credential-harvesting pages. The SVG files contained obfuscated, business-themed code patterns that Microsoft said were consistent with large language model-assisted generation.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers leveraged artificial intelligence to generate highly obfuscated code within phishing campaigns, using complex and verbose scripts embedded in SVG files to evade detection. Microsoft Threat Intelligence identified and blocked a credential phishing operation that utilized AI-generated code, making the malicious payload difficult to analyze and detect with traditional security tools. The phishing emails mimicked file-sharing notifications and used self-address tactics to bypass basic email filters, with attachments designed to appear as legitimate PDF documents but actually being SVG files containing hidden JavaScript. The campaign primarily targeted US-based organizations and highlights the growing trend of cybercriminals adopting AI to enhance the sophistication and stealth of their attacks. Despite the advanced obfuscation, Microsoft's AI-powered security systems successfully detected and mitigated the threat, underscoring the importance of AI-driven defenses against evolving attacker techniques.
Jun 29, 2026
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026
Hackers have launched a sophisticated phishing campaign that impersonates official notices from the National Police of Ukraine to target organizations running Microsoft Windows. The campaign begins with emails containing malicious Scalable Vector Graphics (SVG) files, which are exploited due to their text-based nature that allows embedding of harmful scripts. When recipients open the SVG attachment, they are presented with a deceptive loading screen, after which the system downloads password-protected ZIP archives such as ergosystem.zip or smtpB.zip. The password is provided in the email to increase the appearance of legitimacy. Inside these archives, a Compiled HTML Help (CHM) file acts as the main trigger, executing a malicious script known as CountLoader. This loader connects to a remote server, exfiltrates basic system information, and then delivers the final malware payloads directly into memory, making detection challenging. The two primary payloads identified are Amatera Stealer, which is designed to steal sensitive data, and PureMiner, a cryptominer that hijacks system resources for illicit cryptocurrency mining. PureMiner is delivered using DLL sideloading techniques from the ZIP archive, while Amatera Stealer is deployed through the same infection chain. Security researchers have highlighted the dual threat posed by this campaign: data theft and resource hijacking. The use of SVG files is particularly concerning because they can contain embedded JavaScript and HTML, and on Windows systems, they are often opened by Microsoft Edge, which may lack adequate security controls if not the user's primary browser. The attackers use formal legal language in the phishing emails to pressure recipients into compliance, increasing the likelihood of infection. The campaign is notable for its fileless approach, as the malware is loaded directly into memory rather than being written to disk. This method complicates detection and remediation efforts for security teams. The infection chain leverages social engineering, technical obfuscation, and multiple stages to maximize its effectiveness. Researchers have also observed creative obfuscation within the SVG files, such as disguising malicious code with food and recipe-related variable names. The campaign demonstrates a high level of technical sophistication and adaptability, exploiting both human and technical vulnerabilities. Organizations are advised to educate users about the risks of opening unexpected attachments, especially SVG files, and to implement robust endpoint protection capable of detecting fileless threats. The campaign underscores the ongoing evolution of phishing tactics and the need for continuous vigilance in email security. Security teams should review their email filtering and endpoint monitoring policies to address this emerging threat vector. The use of password-protected archives and legitimate-seeming legal notices increases the campaign's success rate, making it a significant concern for enterprises.
Jun 29, 2026