Seemingly harmless SVGs are packed with malicious JavaScript for a phishing redirect to actor-controlled URLs.

The malicious code is hidden within a CDATA section of the SVG file and relies on a static XOR key to decrypt a payload at ...

This attack is made through embedded SVG files containing JavaScript that reassemble a Base64 encoded QBot malware installer that is automatically downloaded through the target's browser.

Adobe announced that it has released Snap.svg, a new open-source JavaScript library on GitHub.