SVG attachments mislabelled as plain text carried JavaScript into 5,527 organizations

The script does not sit in the file as readable code. In INKY's samples a minimal graphic shell hid obfuscated JavaScript that rebuilt its strings at runtime and fetched a remote endpoint ^[7], with deferred execution and runtime script injection to keep the behaviour away from static inspection ^[8]. No software flaw is involved. SVG is a format that can hold JavaScript, and the attachment is the bridge from the voicemail pretext to executable browser content ^[7][12].

The evasion that mattered was one line of metadata. The attachments announced a MIME type of text/plain instead of image/svg+xml, so a scanner keying on the stated type saw an inert text file ^[6]. Declared content type is attacker-supplied, so a gateway rule that trusts it functions as documentation rather than a control; the decision is whether you inspect or strip by extension and by the bytes.

Averaged across 5,527 organizations, the 26,589 messages work out to 4.8 each ^[17], but the median organization got two and 32% got one, and the ten worst-hit carried only 6% of the total ^[4]. Across the 65-day window the run averaged about 409 messages a day ^[16]. June 3 broke that pattern: 2,432 messages, 9.1% of everything sent, reaching 1,149 organizations, or 21% of every organization the campaign ever touched, inside one day ^[15][20][21].

Microsoft's native scoring is where this gets operationally uncomfortable. Some 19,994 messages, 75%, landed at Spam Confidence Level 0 or 1, which Microsoft treats as not spam; 4,777, 18%, drew SCL 5 ^[10]. That leaves 1,818 messages, 6.8%, in neither reported bucket ^[18]. INKY says the campaign was built from a single template that drew different native verdicts depending on the receiving mailbox ^[11], which means per-tenant score tuning is not a detection layer for this.

Most organizations already own a cheaper control than an SVG policy. INKY reports 95% of the messages claimed to come from the recipient's own domain while arriving from an external sender that had never authenticated to that organization's mail server ^[9]. On the reported total that is roughly 25,260 messages, leaving about 1,330 that did not use internal spoofing ^[19]. Rejecting inbound mail that asserts your own domain without authenticating catches the larger share. SVG handling catches the remainder, and the next campaign that keeps the attachment and drops the pretext.

One caveat on the counts. They come from a single vendor's customer telemetry, written up on August 27 ^[14], and SC Media's item is a summary that credits Infosecurity Magazine rather than separate observation, rounding 5,527 to over 5,500 ^[13]. INKY also said the campaign was still running when its analysis closed ^[3], so June through August 4 is a floor, not a total.