# New Wave of SVG-Attachment Phishing — application/ecmascript MIME Evasion + XOR-Decoded Browser Redirect (chinougoo.cfd)

> An active phishing wave delivers SVG email attachments that contain no graphical element — only embedded JavaScript that redirects the victim's browser to a credential-harvesting page. The campaign abuses the official application/ecmascript MIME type on the <script> tag to bypass controls that pattern-match on 'JavaScript', and hides the redirect destination in a Base64-then-XOR obfuscated string decoded with a dynamically reassembled atob(). Because Windows opens SVG files in the browser by default, the attachment self-executes on open.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0657
- **ID:** TL-2026-0657
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Threadlinqs is tracking an active wave of phishing emails that abuse SVG file attachments as self-executing redirectors, documented by SANS Internet Storm Center (diary 33040, Xavier Mertens, 2026-06-02) after mailboxes were observed being flooded with the lure.

DELIVERY: The phishing email carries an SVG file as an attachment and contains no URL in the message body — the 'image' is the entire payload. This sidesteps URL-reputation and link-rewriting controls that inspect email body links, because there is no link to inspect. SVG is an XML-based vector format that browsers render and execute natively; on Windows the default handler for .svg is the browser, so double-clicking the attachment opens it in a browser context where its embedded script runs immediately.

PAYLOAD STRUCTURE: Unlike a legitimate vector graphic, the malicious SVG contains no <path>, <rect>, <circle>, or other drawable element. Its only meaningful content is a single <script type="application/ecmascript"> block. application/ecmascript is the ECMA-262-standardized, fully valid MIME type for ECMAScript; browsers honor it identically to text/javascript. Using it here is a deliberate, low-cost evasion: many email gateways, sandboxes, and YARA/regex content rules key on the literal strings 'javascript' or 'text/javascript', and a <script> tag declaring application/ecmascript can slip past those naive matches while still executing.

OBFUSCATION & DECODE CHAIN: The redirect destination is not stored in cleartext. It is held in a variable (observed as 'oa') as a Base64-encoded blob that has additionally been XOR-encrypted. The decoder reconstructs the atob function name at runtime from a character array — e.g. self[[cx[4], cx[3], cx[2], cx[0]].join('')] — so the literal token 'atob' never appears in the source, defeating string-based detection of Base64 decoding. The XOR key is assembled from two hex string fragments: pt = 'b19208caeefa' and rm = '51d1e7dcd384', concatenated into bd = 'b19208caeefa51d1e7dcd384' (24 hex characters). After Base64 decoding, each byte is XOR'd against the key cycled by index: Uint8Array.from(ts, (aa, ak) => aa.charCodeAt(0) ^ bd.charCodeAt(ak % bd.length)). The decoded result is the redirect URL.

TARGETING: A separate variable (observed as 'nl') holds the targeted recipient's email address, Base64-encoded (e.g. the SANS analyst's sample contained '$aGFuZGxlcnNAc2Fucy5lZHU=' = 'handlers@sans.edu'). The script appends this victim-specific email to the redirect URL, so each landing-page visit is pre-attributed to the intended victim — a technique that both pre-fills the phishing form and lets the operator track which recipients engaged.

REDIRECT & LANDING: The script sets window.location.href to 'hxxps://chinougoo[.]cfd/W74rH61S!x7sbhhS0bKPv/' concatenated with the victim email, navigating the browser to the operator's credential-phishing page. The destination domain uses the cheap, increasingly-abused .cfd ('Clothing, Fashion, and Design') TLD. At time of analysis chinougoo.cfd resolved to 23.95.206.229, a US ColoCrossing/HostPapa-attributed address (NetName CC-16, 23.94.0.0/15). BeaconBeagle returned no C2-framework configuration for the domain or IP, consistent with a commodity credential-harvesting page rather than implant C2.

IMPACT & TRAJECTORY: SANS rated the campaign threat level green. The currently observed payload is a conventional credential-phishing page, but the delivery primitive — a self-executing, body-link-free SVG that runs arbitrary JavaScript in the victim's browser on open — is payload-agnostic and could be repurposed for token theft, drive-by, or further redirection. The notable, defensible TTP shift is the use of the application/ecmascript MIME string specifically to defeat 'JavaScript'-substring detection, combined with runtime reassembly of atob to hide the decode step.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1204 User Execution
- T1204.002 User Execution: Malicious File
- T1027 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1056.003 Input Capture: Web Portal Capture
- T1598.002 Phishing for Information: Spearphishing Attachment

## Sources

- [New Wave Of Phishing Emails with SVG Files (SANS ISC Diary 33040, Xavier Mertens)](https://isc.sans.edu/diary/33040)
- [Increase In Phishing SVG Attachments (SANS ISC Diary 31456, related prior TTP)](https://isc.sans.edu/diary/Increase+In+Phishing+SVG+Attachments/31456)
- [Cloudflare Radar — .cfd TLD abuse reference](https://radar.cloudflare.com/tlds/cfd)
- [MITRE ATT&CK T1566.001 — Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [MITRE ATT&CK T1027.013 — Obfuscated Files or Information: Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013/)
- [MDN — SVG <script> element and scripting in SVG](https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0657