Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing — Threadlinqs Intelligence
As of 2026-08-30, Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing is a high-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-2230 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
A broad-spray phishing campaign running June 1 - August 4, 2026 disguised malicious SVG attachments as voicemail notifications, declaring a text/plain MIME type to hide active script content from
Between June 1 and August 4, 2026, INKY (part of Kaseya) tracked a large, non-targeted phishing campaign that used SVG file attachments styled as voicemail-player notifications ('PLAY_Voice-....svg', and in individually documented instances 'Voicemail_vRecording_118sec_<token>.svg') to smuggle obfuscated JavaScript past email security controls. The campaign's central evasion technique was MIME-type mislabeling: attachments that are structurally SVG/XML documents (and therefore capable of embedding and executing script the way a browser executes any other HTML/XML+JS document) declared a Content-Type of text/plain instead of image/svg+xml. Security tooling and native filters that key off the stated MIME type treated the files as inert text, letting the active content through unexamined.
The email lure itself was near-uniform: 99.5% of subject lines matched a mechanically generated voicemail-notification template ('mCaller left <recipient-local-part> - 34s Preview vHC- <date> <number>') built from the recipient's own address, and 95% of messages spoofed the recipient's own domain as the apparent sender while actually arriving unauthenticated from outside infrastructure. Message bodies were left blank, giving content-scoring engines nothing to flag. Two independently documented instances captured by IRONSCALES on June 1, 2026 show the mechanics concretely: messages relayed through the legitimate SparkPost transactional email service (host mta-80-125.sparkpostmail.com, IPs 74.208.79.14 and 74.208.24.40) failed SPF, DKIM, and DMARC outright, yet were delivered to the inbox — in one case via Microsoft assigning an SCL of -1 that effectively whitelisted the message, in another via an allow-list override on a VIP mailbox — illustrating how borrowed ESP reputation (a 'reputational halo') and advisory-only DMARC enforcement let comprehensively-failed authentication still reach recipients.
Inside the SVG, INKY's analysis found a minimal decorative graphic shell (rectangles, sometimes wrapped in <foreignObject>/CDATA blocks) concealing obfuscated JavaScript. The script reconstructs strings at runtime with String.fromCharCode() (e.g., building 'https' and '.php' character-by-character) rather than embedding them as static, signature-matchable text; uses deliberately meaningless identifier names that are randomized per sample (examples: intronGap91, riboUnit30, vectorArm37, codonBuf13Go, primerSet56) to defeat fixed hash/signature detection across the campaign; and defers execution via requestIdleCallback or setTimeout so behavior doesn't trigger during the first moments of automated sandbox observation. Once running, the script calls window.fetch() against an attacker-controlled endpoint to pull the next-stage payload at runtime instead of embedding it statically. INKY describes that fetched content as generally an adversary-in-the-middle (AiTM) credential-harvesting page impersonating a widely used login (Microsoft 365, Google Workspace, or Adobe), of the kind that relays credentials through to the real service and captures session tokens in the process — enabling account takeover even against MFA-protected accounts. A related, independently documented instance of the same lure family shows a complementary rendering-evasion trick: a full-viewport, fully transparent CSS overlay (position:fixed; opacity:0; pointer-events:none) that keeps the active script layer invisible to the user across the entire window.
The campaign showed no evidence of precision targeting: median messages per organization was 2, 32% of organizations received only a single message, and the 10 most-affected organizations accounted for just 6% of total volume — consistent with broad, opportunistic spray delivery rather than spear-phishing. This sits within a broader, well-documented rise in weaponized SVG attachments: Hoxhunt telemetry shows SVG-based attachment phishing rising from roughly 0.1% of attachment-based phishing in 2024 to a 15% peak share in March 2025,
Weaknesses (CWE)
CWE-451, CWE-830
Target sectors: cross-sector
Target regions: North America
Timeline
- SVG-attachment phishing share of all attachment-based phishing peaks at 15% for the month (up from a 0.1% baseline in 2024, per Hoxhunt telemetry), establishing the broader SVG-smuggling trend this campaign builds on.
- Hoxhunt publishes its SVG Phishing Email Attachments mini-report documenting the H1 2025 surge and evasion mechanics that foreshadow the voicemail-lure campaign.
- Microsoft's own threat tracking, cited by INKY/Kaseya's later analysis, begins observing related SVG/voicemail-lure phishing techniques ahead of the June wave.
- INKY's tracked fake-voicemail SVG campaign begins; the same day, IRONSCALES separately documents and quarantines a matching instance (sender 'ohr.customersvc@...', relayed via mta-80-125.sparkpostmail.com from IP 74.208.79.14) with SPF, DKIM, and DMARC all failing yet delivered at Microsoft SCL -1.
- Campaign volume peaks: 2,432 messages reach 1,149 organizations in a single day.
- Last date within INKY's tracked campaign window (June 1 - August 4, 2026); message waves largely paused on weekends throughout the run.
- INKY/Kaseya publishes 'SVG Smuggling: How a 26,000-Email Phishing Campaign Hid Malware in Image Files,' detailing the MIME-spoofing, obfuscation, and AiTM follow-on mechanics.
- Infosecurity Magazine publishes coverage of INKY's findings, bringing the campaign to broader industry attention.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1566.001, T1204.002, T1684.001, T1027, T1027.006, T1071.001, T1557, T1539, T1583.001, T1585.002
