A two-month phishing campaign used scalable vector graphics (SVG) attachments disguised as voicemail files to smuggle obfuscated JavaScript past email defenses, with 26,589 messages detected across 5527 organizations.
Email security vendor INKY, which is part of Kaseya, detected and flagged the messages. In a technical write-up published on August 27, INKY said that the campaign ran from June 1 through August 4, 2026 in waves, largely stopping at weekends.
The largest spike came on June 3, when 2432 messages reached 1149 organizations. INKY said the campaign was still running when its analysis closed.
The operation showed little evidence of precision targeting. The median organization received two messages, while 32% received only one.
The 10 most-affected organizations accounted for just 6% of the total volume, consistent with broad spray delivery rather than a tightly focused spear-phishing campaign.
SVG Smuggling Adds a Second Evasion Layer
The lure presented itself as an internal voicemail notification, with 99.5% of subjects incorporating the local part of the recipient’s own email address. Attachments used voicemail-style names and carried SVG and XML content.
Those attachments declared a MIME type of text/plain rather than image/svg+xml, so a scanner keying on the stated type would see an innocuous text file rather than active content.
That distinction mattered because SVG files can contain JavaScript. In the samples analyzed by INKY, a minimal graphic shell concealed obfuscated script that reconstructed strings at runtime and fetched a remote endpoint.
The code also used deferred execution and runtime script injection, making its behavior harder to identify through static inspection.
Read more on SVG phishing: AI-Generated Code Used in Phishing Campaign Blocked by Microsoft
Native Spam Filtering Missed Most Messages
The campaign leaned heavily on internal spoofing. INKY said 95% of the messages claimed to come from the recipient’s own domain while arriving from an external sender that had never authenticated to the organization’s mail server.
Native spam scoring treated most of the campaign as harmless. Some 19,994 messages (75%), received a Microsoft Spam Confidence Level (SCL) of 0 or 1, which Microsoft treats as not spam, while only 4777 (18%) were assigned SCL 5.
INKY noted that the campaign was built from a single template, yet the same message drew different native verdicts depending on the receiving mailbox.
These findings reinforce how the campaign combined several individually plausible signals: a familiar voicemail pretext, an image format, recipient-specific personalization and an internal sender impersonation.
The SVG attachment supplied the bridge between those social-engineering elements and executable browser content.
