Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing

Fake Voicemail SVG Phishing Campaign Bypasses Email Filters (TL-2026-2230), also tracked as Fake Voicemail SVG Campaign, is a high-severity phishing campaign, first published 2026-08-30. It has no confirmed attribution, affects Multiple / Cross-Vendor Secure email gateways and native anti-spam, maps to 11 MITRE ATT&CK techniques (T1027, T1027.006, T1071.001), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2230

Threat ID
TL-2026-2230
Also known as
Fake Voicemail SVG Campaign, SVG Smuggling Campaign, mCaller Voicemail Phishing
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-08-30
Last reviewed
2026-08-30
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cross-sector
Target regions
North America
Detection rules
9
Indicators of compromise
12

A broad-spray phishing campaign running June 1 - August 4, 2026 disguised malicious SVG attachments as voicemail notifications, declaring a text/plain MIME type to hide active script content from filters that trust declared attachment type over actual content. INKY (Kaseya) detected and flagged all 26,589 messages across 5,527 organizations, while Microsoft's native filtering scored 75% of the same traffic as clean (SCL 0-1); documented instances show the payload fetching adversary-in-the-middle credential-harvesting infrastructure capable of session-token theft.

How Fake Voicemail SVG Phishing Campaign Bypasses Email Filters works

Between June 1 and August 4, 2026, INKY (part of Kaseya) tracked a large, non-targeted phishing campaign that used SVG file attachments styled as voicemail-player notifications ('PLAY_Voice-....svg', and in individually documented instances 'Voicemail_vRecording_118sec_<token>.svg') to smuggle obfuscated JavaScript past email security controls. The campaign's central evasion technique was MIME-type mislabeling: attachments that are structurally SVG/XML documents (and therefore capable of embedding and executing script the way a browser executes any other HTML/XML+JS document) declared a Content-Type of text/plain instead of image/svg+xml. Security tooling and native filters that key off the stated MIME type treated the files as inert text, letting the active content through unexamined.

The email lure itself was near-uniform: 99.5% of subject lines matched a mechanically generated voicemail-notification template ('mCaller left <recipient-local-part> - 34s Preview vHC- <date> <number>') built from the recipient's own address, and 95% of messages spoofed the recipient's own domain as the apparent sender while actually arriving unauthenticated from outside infrastructure. Message bodies were left blank, giving content-scoring engines nothing to flag. Two independently documented instances captured by IRONSCALES on June 1, 2026 show the mechanics concretely: messages relayed through the legitimate SparkPost transactional email service (host mta-80-125.sparkpostmail.com, IPs 74.208.79.14 and 74.208.24.40) failed SPF, DKIM, and DMARC outright, yet were delivered to the inbox — in one case via Microsoft assigning an SCL of -1 that effectively whitelisted the message, in another via an allow-list override on a VIP mailbox — illustrating how borrowed ESP reputation (a 'reputational halo') and advisory-only DMARC enforcement let comprehensively-failed authentication still reach recipients.

Inside the SVG, INKY's analysis found a minimal decorative graphic shell (rectangles, sometimes wrapped in <foreignObject>/CDATA blocks) concealing obfuscated JavaScript. The script reconstructs strings at runtime with String.fromCharCode() (e.g., building 'https' and '.php' character-by-character) rather than embedding them as static, signature-matchable text; uses deliberately meaningless identifier names that are randomized per sample (examples: intronGap91, riboUnit30, vectorArm37, codonBuf13Go, primerSet56) to defeat fixed hash/signature detection across the campaign; and defers execution via requestIdleCallback or setTimeout so behavior doesn't trigger during the first moments of automated sandbox observation. Once running, the script calls window.fetch() against an attacker-controlled endpoint to pull the next-stage payload at runtime instead of embedding it statically. INKY describes that fetched content as generally an adversary-in-the-middle (AiTM) credential-harvesting page impersonating a widely used login (Microsoft 365, Google Workspace, or Adobe), of the kind that relays credentials through to the real service and captures session tokens in the process — enabling account takeover even against MFA-protected accounts. A related, independently documented instance of the same lure family shows a complementary rendering-evasion trick: a full-viewport, fully transparent CSS overlay (position:fixed; opacity:0; pointer-events:none) that keeps the active script layer invisible to the user across the entire window.

The campaign showed no evidence of precision targeting: median messages per organization was 2, 32% of organizations received only a single message, and the 10 most-affected organizations accounted for just 6% of total volume — consistent with broad, opportunistic spray delivery rather than spear-phishing. This sits within a broader, well-documented rise in weaponized SVG attachments: Hoxhunt telemetry shows SVG-based attachment phishing rising from roughly 0.1% of attachment-based phishing in 2024 to a 15% peak share in March 2025, and ReversingLabs has separately tracked a related, more targeted 2026 wave of fake-voicemail-themed SVG phishing aimed at named individuals (administrative contacts, executives, financial managers) in healthcare, construction, and banking, using its own distinct domain and file-hash infrastructure. No CVE, malware family, or threat-actor attribution has been disclosed by any source; the technique is an abuse of legitimate SVG/browser capability and of gateway/filter trust assumptions rather than a specific software vulnerability.

MITRE ATT&CK techniques used in TL-2026-2230

Defense Evasion

T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling; T1684.001 Impersonation

Command and Control

T1071.001 Web Protocols

Execution

T1204.002 Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Domains; T1585.002 Email Accounts; T1608 Stage Capabilities

Affected products and versions in Fake Voicemail SVG Phishing Campaign Bypasses Email Filters

  • Multiple / Cross-Vendor — Secure email gateways and native anti-spam filters that classify attachments by declared Content-Type/MIME header
    Vulnerable versions: Filtering logic that trusts a sender-declared text/plain MIME header over inspection of actual SVG/XML file content
    Fixed in: Content-based or behavioral SVG inspection that ignores the declared MIME type
  • Microsoft — Microsoft 365 / Exchange Online Protection (native anti-spam SCL scoring)
    Vulnerable versions: Native EOP/SCL scoring as observed during the June-August 2026 campaign window, which scored 75% of campaign messages SCL 0-1 and, in a documented instance, assigned SCL -1 to a message with SPF=none/DKIM=none/DMARC=fail
    Fixed in: No vendor patch; requires layered behavioral detection and DMARC enforcement rather than relying on native SCL scoring alone
  • W3C / browser vendors — Web browsers and email-client SVG renderers (SVG format natively supports embedded <script>/<foreignObject> content)
    Vulnerable versions: Default SVG rendering with embedded JavaScript execution enabled
    Fixed in: N/A - by-design SVG/browser capability; mitigated by blocking/sandboxing SVG attachments, not by a vendor patch

Remediation for Fake Voicemail SVG Phishing Campaign Bypasses Email Filters

Immediate actions

  • Block or quarantine inbound SVG attachments at the email gateway; treat SVG as active/executable content equivalent to HTML rather than as an image type
  • Enforce DMARC so a fail verdict actually blocks/quarantines delivery instead of being overridden by allow-lists or ESP reputational trust
  • Deploy content-based attachment inspection that does not rely on the sender-declared Content-Type/MIME header to classify attachments

Workarounds

  • Train users to recognize voicemail-notification lures that are mechanically personalized with their own email address as the caller/subject name
  • Disable or strip SVG active-content rendering in webmail/email clients where SVG attachments are not a business necessity

Longer-term hardening

  • Adopt phishing-resistant authentication (FIDO2/WebAuthn hardware security keys) to blunt session-token theft from AiTM credential-harvesting portals
  • Deploy behavioral/ICES (Integrated Cloud Email Security) tooling that renders and analyzes SVG/HTML DOM and script behavior rather than relying on static signatures
  • Monitor for abuse of legitimate ESP relay infrastructure (e.g., SparkPost) being used to launder the reputation of spoofed-sender phishing traffic

Weaknesses (CWE) in Fake Voicemail SVG Phishing Campaign Bypasses Email Filters

CWE-451, CWE-830

Timeline of Fake Voicemail SVG Phishing Campaign Bypasses Email Filters

  • SVG-attachment phishing share of all attachment-based phishing peaks at 15% for the month (up from a 0.1% baseline in 2024, per Hoxhunt telemetry), establishing the broader SVG-smuggling trend this campaign builds on.
  • Hoxhunt publishes its SVG Phishing Email Attachments mini-report documenting the H1 2025 surge and evasion mechanics that foreshadow the voicemail-lure campaign.
  • Microsoft's own threat tracking, cited by INKY/Kaseya's later analysis, begins observing related SVG/voicemail-lure phishing techniques ahead of the June wave.
  • INKY's tracked fake-voicemail SVG campaign begins; the same day, IRONSCALES separately documents and quarantines a matching instance (sender 'ohr.customersvc@...', relayed via mta-80-125.sparkpostmail.com from IP 74.208.79.14) with SPF, DKIM, and DMARC all failing yet delivered at Microsoft SCL -1.
  • Campaign volume peaks: 2,432 messages reach 1,149 organizations in a single day.
  • Last date within INKY's tracked campaign window (June 1 - August 4, 2026); message waves largely paused on weekends throughout the run.
  • INKY/Kaseya publishes 'SVG Smuggling: How a 26,000-Email Phishing Campaign Hid Malware in Image Files,' detailing the MIME-spoofing, obfuscation, and AiTM follow-on mechanics.
  • Infosecurity Magazine publishes coverage of INKY's findings, bringing the campaign to broader industry attention.

Sources cited for Fake Voicemail SVG Phishing Campaign Bypasses Email Filters

More in phishing

Detection coverage for TL-2026-2230

As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2230 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats