Threadlinqs is tracking an active wave of phishing emails that abuse SVG file attachments as self-executing redirectors, documented by SANS Internet Storm Center (diary 33040, Xavier Mertens, 2026-06-02) after mailboxes were observed being flooded with the lure.

DELIVERY: The phishing email carries an SVG file as an attachment and contains no URL in the message body — the 'image' is the entire payload. This sidesteps URL-reputation and link-rewriting controls that inspect email body links, because there is no link to inspect. SVG is an XML-based vector format that browsers render and execute natively; on Windows the default handler for .svg is the browser, so double-clicking the attachment opens it in a browser context where its embedded script runs immediately.

PAYLOAD STRUCTURE: Unlike a legitimate vector graphic, the malicious SVG contains no <path>, <rect>, <circle>, or other drawable element. Its only meaningful content is a single <script type="application/ecmascript"> block. application/ecmascript is the ECMA-262-standardized, fully valid MIME type for ECMAScript; browsers honor it identically to text/javascript. Using it here is a deliberate, low-cost evasion: many email gateways, sandboxes, and YARA/regex content rules key on the literal strings 'javascript' or 'text/javascript', and a <script> tag declaring application/ecmascript can slip past those naive matches while still executing.

OBFUSCATION & DECODE CHAIN: The redirect destination is not stored in cleartext. It is held in a variable (observed as 'oa') as a Base64-encoded blob that has additionally been XOR-encrypted. The decoder reconstructs the atob function name at runtime from a character array — e.g. self[[cx[4], cx[3], cx[2], cx[0]].join('')] — so the literal token 'atob' never appears in the source, defeating string-based detection of Base64 decoding. The XOR key is assembled from two hex string fragments: pt = 'b19208caeefa' and rm = '51d1e7dcd384', concatenated into bd = 'b19208caeefa51d1e7dcd384' (24 hex characters). After Base64 decoding, each byte is XOR'd against the key cycled by index: Uint8Array.from(ts, (aa, ak) => aa.charCodeAt(0) ^ bd.charCodeAt(ak % bd.length)). The decoded result is the redirect URL.

TARGETING: A separate variable (observed as 'nl') holds the targeted recipient's email address, Base64-encoded (e.g. the SANS analyst's sample contained '$aGFuZGxlcnNAc2Fucy5lZHU=' = 'handlers@sans.edu'). The script appends this victim-specific email to the redirect URL, so each landing-page visit is pre-attributed to the intended victim — a technique that both pre-fills the phishing form and lets the operator track which recipients engaged.

REDIRECT & LANDING: The script sets window.location.href to 'hxxps://chinougoo[.]cfd/W74rH61S!x7sbhhS0bKPv/' concatenated with the victim email, navigating the browser to the operator's credential-phishing page. The destination domain uses the cheap, increasingly-abused .cfd ('Clothing, Fashion, and Design') TLD. At time of analysis chinougoo.cfd resolved to 23.95.206.229, a US ColoCrossing/HostPapa-attributed address (NetName CC-16, 23.94.0.0/15). BeaconBeagle returned no C2-framework configuration for the domain or IP, consistent with a commodity credential-harvesting page rather than implant C2.

IMPACT & TRAJECTORY: SANS rated the campaign threat level green. The currently observed payload is a conventional credential-phishing page, but the delivery primitive — a self-executing, body-link-free SVG that runs arbitrary JavaScript in the victim's browser on open — is payload-agnostic and could be repurposed for token theft, drive-by, or further redirection. The notable, defensible TTP shift is the use of the application/ecmascript MIME string specifically to defeat 'JavaScript'-substring detection, combined with runtime reassembly of atob to hide the decode step.