Seemingly harmless SVGs are packed with malicious JavaScript for a phishing redirect to actor-controlled URLs.

This attack is made through embedded SVG files containing JavaScript that reassemble a Base64 encoded QBot malware installer that is automatically downloaded through the target's browser.

Adobe announced that it has released Snap.svg, a new open-source JavaScript library on GitHub.