The Image That Isn't - Stopping SVG-Borne Attacks
Symantec, Monday, September 28th, 2026
Symantec explains how attackers hide phishing and malware in SVG files and how layered protections break the chain.
Symantec says SVG files, made of XML that browsers parse and execute, can carry scripts and render convincing login pages while passing filters built for executables and archives.
SVG is now among the top three malicious attachment types, and Symantec telemetry shows it went quiet in the first half of 2026 before returning sharply in August.
The post covers recent campaigns spanning credential phishing, archive smuggling and targeted malware delivery, and how file-based, machine learning, email and web protections stop them.