Talos researchers uncovered a phishing campaign distributing the QBot malware using a new technique that leverages Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
Once a victim receives the email and opens the attachment, their browser decodes and runs the embedded script, which then assembles a malicious payload directly on the victim’s device.
The QBot malware spread via phishing messages, the threat is able to hijack a victim’s email and send itself out as a reply to an existing email thread.
If the recipient enters the password provided by the attacker and opens the zip archive, it can extract an .ISO file. The .iso file allows infecting the victim with the Qakbot malware.
“Since HTML smuggling can bypass traditional network defenses, it is critical to deploy some sort of security protection to the endpoints in your environment. Having robust endpoint protection can prevent execution of potentially obfuscated scripts, and prevent scripts from launching downloaded executable content. Endpoint security can also enforce rules about which executables are trusted to run in your environment.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
|[adrotate banner=”9″]||[adrotate banner=”12″]|
(SecurityAffairs – hacking, HTML smuggling)