New Wave of SVG-Attachment Phishing — application/ecmascript MIME Evasion + XOR-Decoded Browser Redirect (chinougoo.cfd) — Threadlinqs Intelligence
As of 2026-06-02, New Wave of SVG-Attachment Phishing — application/ecmascript MIME Evasion + XOR-Decoded Browser Redirect (chinougoo.cfd) is a medium-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-0657 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
An active phishing wave delivers SVG email attachments that contain no graphical element — only embedded JavaScript that redirects the victim's browser to a credential-harvesting page. The campaign
Threadlinqs is tracking an active wave of phishing emails that abuse SVG file attachments as self-executing redirectors, documented by SANS Internet Storm Center (diary 33040, Xavier Mertens, 2026-06-02) after mailboxes were observed being flooded with the lure.
DELIVERY: The phishing email carries an SVG file as an attachment and contains no URL in the message body — the 'image' is the entire payload. This sidesteps URL-reputation and link-rewriting controls that inspect email body links, because there is no link to inspect. SVG is an XML-based vector format that browsers render and execute natively; on Windows the default handler for .svg is the browser, so double-clicking the attachment opens it in a browser context where its embedded script runs immediately.
PAYLOAD STRUCTURE: Unlike a legitimate vector graphic, the malicious SVG contains no <path>, <rect>, <circle>, or other drawable element. Its only meaningful content is a single <script type="application/ecmascript"> block. application/ecmascript is the ECMA-262-standardized, fully valid MIME type for ECMAScript; browsers honor it identically to text/javascript. Using it here is a deliberate, low-cost evasion: many email gateways, sandboxes, and YARA/regex content rules key on the literal strings 'javascript' or 'text/javascript', and a <script> tag declaring application/ecmascript can slip past those naive matches while still executing.
OBFUSCATION & DECODE CHAIN: The redirect destination is not stored in cleartext. It is held in a variable (observed as 'oa') as a Base64-encoded blob that has additionally been XOR-encrypted. The decoder reconstructs the atob function name at runtime from a character array — e.g. self[[cx[4], cx[3], cx[2], cx[0]].join('')] — so the literal token 'atob' never appears in the source, defeating string-based detection of Base64 decoding. The XOR key is assembled from two hex string fragments: pt = 'b19208caeefa' and rm = '51d1e7dcd384', concatenated into bd = 'b19208caeefa51d1e7dcd384' (24 hex characters). After Base64 decoding, each byte is XOR'd against the key cycled by index: Uint8Array.from(ts, (aa, ak) => aa.charCodeAt(0) ^ bd.charCodeAt(ak % bd.length)). The decoded result is the redirect URL.
TARGETING: A separate variable (observed as 'nl') holds the targeted recipient's email address, Base64-encoded (e.g. the SANS analyst's sample contained '$aGFuZGxlcnNAc2Fucy5lZHU=' = 'handlers@sans.edu'). The script appends this victim-specific email to the redirect URL, so each landing-page visit is pre-attributed to the intended victim — a technique that both pre-fills the phishing form and lets the operator track which recipients engaged.
REDIRECT & LANDING: The script sets window.location.href to 'hxxps://chinougoo[.]cfd/W74rH61S!x7sbhhS0bKPv/' concatenated with the victim email, navigating the browser to the operator's credential-phishing page. The destination domain uses the cheap, increasingly-abused .cfd ('Clothing, Fashion, and Design') TLD. At time of analysis chinougoo.cfd resolved to 23.95.206.229, a US ColoCrossing/HostPapa-attributed address (NetName CC-16, 23.94.0.0/15). BeaconBeagle returned no C2-framework configuration for the domain or IP, consistent with a commodity credential-harvesting page rather than implant C2.
IMPACT & TRAJECTORY: SANS rated the campaign threat level green. The currently observed payload is a conventional credential-phishing page, but the delivery primitive — a self-executing, body-link-free SVG that runs arbitrary JavaScript in the victim's browser on open — is payload-agnostic and could be repurposed for token theft, drive-by, or further redirection. The notable, defensible TTP shift is the use of the application/ecmascript MIME string specifically to defeat 'JavaScript'-substring detection, combined with runtime reassembly of atob to hide the decode step.
Weaknesses (CWE)
CWE-79, CWE-116, CWE-1021
Target sectors: cross-sector, education, financial, technology
Target regions: Global, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1566, T1566.001, T1204, T1204.002, T1027, T1027.013, T1027.010, T1140, T1036, T1056.003