SVG Attachment Phishing Surges Fifty-Fold, Research Finds

The attachment looks like a harmless picture - a logo, a chart, an invoice rendered as an image. But SVG files are not pictures in the way employees assume. They are XML documents that can carry scripts and redirects, and attackers have noticed. New research shows malicious SVG attachments have exploded fifty-fold, quietly becoming one of the most common weapons in attachment-based phishing while many filters still wave them through as 'just an image.'

A Fifty-Fold Surge Puts SVG in Third Place

According to Hoxhunt research published in June 2026, malicious SVG attachments have increased fifty-fold and now account for roughly 5 percent of all malicious attachments observed. That makes SVG the third most common malicious attachment type - overtaking long-standing staples like .docx documents and .eml files.

For a file format most employees have never consciously opened, that is a remarkable climb. It reflects a simple economic reality for attackers: SVGs work, and defenses have not caught up.

From 0.1 Percent to a 15 Percent Peak

The trajectory is even more telling than the snapshot. Hoxhunt's SVG phishing mini-report traces the format from just 0.1 percent of attachment-based phishing in 2024 to a peak of 15 percent of attachment phishing in March 2025 - a wave that SC Media reported continuing well after an initial holiday-season surge.

The targeting is not evenly spread, either. According to Cloudflare research, manufacturing and industrial organizations absorb over half of the observed SVG targeting. If you defend a plant, a supply chain or an OT-adjacent office environment, this format deserves a specific line in your threat model rather than a footnote.

Why an Image File Can Phish You

SVG stands for Scalable Vector Graphics, but the operative word is neither 'vector' nor 'graphics' - it is the fact that the format is XML. Unlike a JPEG or PNG, which browsers treat as inert pixels, an SVG is a structured document that can embed script and redirect logic. As Hoxhunt puts it, attackers are turning images into active code. Cloudflare's research reaches the same conclusion, describing SVGs as a hacker's canvas.

In practice, the attack usually works like this: the victim opens what they believe is an image, the embedded logic executes or redirects in the browser, and the victim lands on a credential-harvesting page dressed up as a familiar login screen. Because many anti-spam and attachment-scanning tools categorize SVGs as images rather than executable content, these payloads sail past controls that would instantly quarantine a macro-enabled document.

The human factor compounds the technical gap. Years of awareness training have taught employees to distrust .exe files, macros and ZIP archives - but nobody warned them about images. An SVG lure arrives with the cleanest reputation an attachment can have.

Part of a Larger Spring 2026 Wave

The SVG surge is not happening in isolation. The same Hoxhunt research reports that malicious phishing emails reported by US users rose 147.3 percent in spring 2026, and that 11 percent of AI-generated phishing emails carried malicious attachments. Generative tooling is making it cheap to produce polished lures at volume, and novel attachment formats give those lures a delivery mechanism that legacy filters underestimate.

Put together, the pattern is clear: attackers are pairing better-written emails with lesser-known file types, and SVG is currently their favorite of the latter.

What to Change: Filters, Policies and Simulations

The response spans technology and training, and neither half works alone.

• Treat SVG as active content at the gateway. Block, quarantine or sandbox inbound SVG attachments unless your organization has a genuine business need for them - most do not receive legitimate SVGs by email.
• Convert where you cannot block. If design or engineering teams need SVGs, route them through channels that flatten or inspect the XML rather than delivering raw files to inboxes.
• Rewrite the mental model in training. Employees need to hear, explicitly, that an image attachment can phish you. 'It is just a picture' is now an outdated assumption, and awareness content should say so.
• Update your phishing simulation design. If your simulated campaigns still lean exclusively on link-based lures and macro documents, they are rehearsing yesterday's attack. Attachment-based scenarios that mirror current attacker behavior - including image-format lures - keep the practice honest. Security awareness training platforms like empowsec make it straightforward to evolve simulation templates as the threat mix shifts.
• Watch the reporting pipeline. A spike in user-reported emails carrying image attachments is an early-warning signal worth dashboarding, given the 147.3 percent rise in reported phishing.

Key Takeaways

• Malicious SVG attachments grew fifty-fold and now make up about 5 percent of malicious attachments - the third most common type, ahead of .docx and .eml.
• The trend is steep: from 0.1 percent of attachment phishing in 2024 to a 15 percent peak in March 2025, with manufacturing and industrial firms absorbing over half of the targeting per Cloudflare's research.
• SVG is XML, not pixels: it can embed script and redirect logic that leads to credential-harvesting pages while bypassing filters that classify it as an image.
• The wider wave is real: reported malicious phishing emails rose 147.3 percent among US users in spring 2026, and 11 percent of AI-generated phishing emails carried malicious attachments.
• Act on both fronts: restrict SVG delivery at the gateway, and update awareness content and phishing simulation templates so employees learn that an image can be an attack.