"Crooks Use HTML Smuggling to Spread QBot Malware via SVG Files"

Talos researchers discovered a phishing campaign using Scalable Vector Graphics (SVG) images embedded in HTML email attachments to distribute the QBot malware. HTML smuggling is an evasive malware delivery method that involves using legitimate HTML5 and JavaScript features. Malicious payloads are delivered through encoded strings in an HTML attachment or webpage. The target device's browser, which is inside the security perimeter of the victim's network, generates the malicious HTML code. When the victim receives the email and opens the attachment, the browser decodes and runs the embedded script, which assembles a malicious payload directly on the victim's device. The embedded SVG files in the attack detailed by Talos contained JavaScript that reassembles a Base64 encoded QBot malware installer. The installer is then automatically downloaded through the victim's browser. The JavaScript embedded in the SVG image contains a malicious ZIP archive. Since the malware payload is assembled directly on the victim's machine rather than being transmitted over the network, this HTML smuggling technique can avoid detection by security devices. The QBot malware, which is spread through phishing messages, can hijack a victim's email and send itself out as a reply to an existing email thread. The smuggled JavaScript code inside the SVG image begins the attack when the recipient opens the HTML attachment. The script generates a password-protected malicious ZIP archive and then prompts the user to save the file. The password can be found in the HTML attachment. If the recipient enters the password provided by the attacker and opens the ZIP archive, an. ISO file can be extracted. The file allows the QBot malware to infect the victim. This article continues to discuss the new phishing campaign distributing the QBot malware to Windows systems using SVG files.

Security Affairs reports "Crooks Use HTML Smuggling to Spread QBot Malware via SVG Files"