SVG smuggling: an infostealer disguised as a court summons

In a case we investigated recently, an .svg file was the initial infection vector in a social-engineering campaign built around a fake legal threat. Many people consider .svg files safe to open because they look like images rather than executable files. That assumption is exactly what makes them interesting to an attacker.

The Lure

A phishing email sent from a Gmail account delivered a file named Citacion obligatoria por amenazas, insultos y trato_0FA5B4.svg, Spanish for “mandatory summons for threats, insults and mistreatment,” styled to look like an official legal notice.

Execution Chain

1. The victim is lured into opening the .svg attachment. SVG is an XML-based format, and XML can carry embedded <script> tags. Most people, and plenty of security tooling, don’t expect an image file to execute JavaScript.
2. The embedded script opens the default browser and redirects to a site imitating a government portal.
3. The fake site serves a download: DEMANDA POR DAÑOS Y PERJUICIOS_BBF259.zip, Spanish for “lawsuit for damages.”
4. Inside the archive, 04 BOLETA JUDICIAL.exe (“court ticket”) acts as a loader.
5. The loader deploys additional components associated with an infostealer.

The File Type is the Trick

No fancy exploits and no macros. The first stage relies on the victim believing that an .svg file is just an image and therefore safe to open. In reality, SVG is a text-based, script-capable format. Pair that with a filename designed to create urgency, a legal threat written in the victim’s own language, and you have a lure aimed at the victim’s judgment rather than at the technical controls protecting the system.

The Infostealer Components

The loader is not the objective. Alongside 04 BOLETA JUDICIAL.exe, the case produced two DLLs (wblindp2.dll, SdAppServices.dll) and two further executables (Crisp.exe, AxisOr.exe): the components the loader exists to stage, and the part of the chain associated with the infostealer.

Remediation

• Treat every credential that was reachable from the host as compromised: browser-saved passwords, session cookies, and application tokens. Reset them and invalidate active sessions rather than only changing passwords.
• Remove the delivered artifacts from the host: the downloaded archive, 04 BOLETA JUDICIAL.exe, and the components listed in the indicators below.
• Pull the spoofed portal domain and the download URL out of the proxy and DNS logs for the affected window, then block them at the network layer and check whether any other host reached them.
• Re-scan the mailbox for further copies of the attachment.

MITRE ATT&CK

Techniques observed in this case.

Tactic	Technique	ID
Initial Access	Phishing: Spearphishing Attachment	T1566.001
Defense Evasion	Obfuscated Files or Information: HTML Smuggling	T1027.006
Execution	User Execution: Malicious File	T1204.002
Execution	Command and Scripting Interpreter: JavaScript	T1059.007
Execution	User Execution: Malicious Link	T1204.001
Defense Evasion	Masquerading: Match Legitimate Name or Location	T1036.005
Command and Control	Ingress Tool Transfer	T1105

The infostealer’s own collection and exfiltration behavior was not confirmed in this investigation, so it is deliberately left unmapped rather than assumed from the family name.

Indicators of compromise

Lure (SVG)             Citacion obligatoria por amenazas, insultos y trato_0FA5B4.svg
Archive                DEMANDA POR DAÃ_OS Y PERJUCIOS_BBF259.zip (encoding artifact as observed)
Loader                 04 BOLETA JUDICIAL.exe
wblindp2.dll           9852c70d507ffe187069aba3e4edf10eba384de8e4a8f962fb1ecd921184a3b4
SdAppServices.dll      8c335c5a4bb3a950432df16b90735d51c962451fb14ccdf486b5340edfe11b4b
04 BOLETA JUDICIAL.exe 19d78cd26cbfeb0800508063359f149f271fd7904d1ee0983ec24ba9efcb11e5
Crisp.exe              c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
AxisOr.exe             cb26f2f14b0c15180014a6262a8599bd0d8e4a0ef44445ee360725df3d18655e

Detection Notes

• Filter on what a format can do, not on what it looks like. SVG is XML, and XML carries <script>. Attachment filtering that flags .exe, .js, and macro-enabled Office documents passes an SVG straight through.
• An image attachment that spawns a browser is the signal. The first observable action in this chain is a default-browser launch originating from an opened attachment. There is no suspicious binary yet at that point, only a process relationship that makes no sense.
• Hunt the components, not the loader. Loaders are disposable, and 04 BOLETA JUDICIAL.exe is only the entry point. A hunt built on the loader hash alone dates badly; the deployed components and the delivery infrastructure hold up longer.

The Takeaway

Nothing here was exploited. Every step of the chain relied on something being trusted for what it appeared to be: an attachment that looked like an image, a portal that looked official, an archive that looked like the document it promised.

That is also where it breaks. The controls that matter are the ones that judge a format by what it can do rather than by its extension, and the analysis that keeps going after the loader has a name.

And the part no control fixes: urgency plus authority still works. A fake summons, in the victim’s own language, from an authority they have no easy way to verify, lands regardless of how it was delivered.