# Fake Voicemail SVG Phishing Campaign Bypasses Email Filters via MIME Spoofing > A broad-spray phishing campaign running June 1 - August 4, 2026 disguised malicious SVG attachments as voicemail notifications, declaring a text/plain MIME type to hide active script content from filters that trust declared attachment type over actual content. INKY (Kaseya) detected and flagged all 26,589 messages across 5,527 organizations, while Microsoft's native filtering scored 75% of the same traffic as clean (SCL 0-1); documented instances show the payload fetching adversary-in-the-middle credential-harvesting infrastructure capable of session-token theft. - **Published:** 2026-08-30T00:00:00Z - **Last reviewed:** 2026-08-30T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2230 - **ID:** TL-2026-2230 - **Severity:** HIGH - **Category:** PHISHING - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier) ## Description Between June 1 and August 4, 2026, INKY (part of Kaseya) tracked a large, non-targeted phishing campaign that used SVG file attachments styled as voicemail-player notifications ('PLAY_Voice-....svg', and in individually documented instances 'Voicemail_vRecording_118sec_.svg') to smuggle obfuscated JavaScript past email security controls. The campaign's central evasion technique was MIME-type mislabeling: attachments that are structurally SVG/XML documents (and therefore capable of embedding and executing script the way a browser executes any other HTML/XML+JS document) declared a Content-Type of text/plain instead of image/svg+xml. Security tooling and native filters that key off the stated MIME type treated the files as inert text, letting the active content through unexamined. The email lure itself was near-uniform: 99.5% of subject lines matched a mechanically generated voicemail-notification template ('mCaller left - 34s Preview vHC- ') built from the recipient's own address, and 95% of messages spoofed the recipient's own domain as the apparent sender while actually arriving unauthenticated from outside infrastructure. Message bodies were left blank, giving content-scoring engines nothing to flag. Two independently documented instances captured by IRONSCALES on June 1, 2026 show the mechanics concretely: messages relayed through the legitimate SparkPost transactional email service (host mta-80-125.sparkpostmail.com, IPs 74.208.79.14 and 74.208.24.40) failed SPF, DKIM, and DMARC outright, yet were delivered to the inbox — in one case via Microsoft assigning an SCL of -1 that effectively whitelisted the message, in another via an allow-list override on a VIP mailbox — illustrating how borrowed ESP reputation (a 'reputational halo') and advisory-only DMARC enforcement let comprehensively-failed authentication still reach recipients. Inside the SVG, INKY's analysis found a minimal decorative graphic shell (rectangles, sometimes wrapped in /CDATA blocks) concealing obfuscated JavaScript. The script reconstructs strings at runtime with String.fromCharCode() (e.g., building 'https' and '.php' character-by-character) rather than embedding them as static, signature-matchable text; uses deliberately meaningless identifier names that are randomized per sample (examples: intronGap91, riboUnit30, vectorArm37, codonBuf13Go, primerSet56) to defeat fixed hash/signature detection across the campaign; and defers execution via requestIdleCallback or setTimeout so behavior doesn't trigger during the first moments of automated sandbox observation. Once running, the script calls window.fetch() against an attacker-controlled endpoint to pull the next-stage payload at runtime instead of embedding it statically. INKY describes that fetched content as generally an adversary-in-the-middle (AiTM) credential-harvesting page impersonating a widely used login (Microsoft 365, Google Workspace, or Adobe), of the kind that relays credentials through to the real service and captures session tokens in the process — enabling account takeover even against MFA-protected accounts. A related, independently documented instance of the same lure family shows a complementary rendering-evasion trick: a full-viewport, fully transparent CSS overlay (position:fixed; opacity:0; pointer-events:none) that keeps the active script layer invisible to the user across the entire window. The campaign showed no evidence of precision targeting: median messages per organization was 2, 32% of organizations received only a single message, and the 10 most-affected organizations accounted for just 6% of total volume — consistent with broad, opportunistic spray delivery rather than spear-phishing. This sits within a broader, well-documented rise in weaponized SVG attachments: Hoxhunt telemetry shows SVG-based attachment phishing rising from roughly 0.1% of attachment-based phishing in 2024 to a 15% peak share in March 2025, and ReversingLabs has separately tracked a related, more targeted 2026 wave of fake-voicemail-themed SVG phishing aimed at named individuals (administrative contacts, executives, financial managers) in healthcare, construction, and banking, using its own distinct domain and file-hash infrastructure. No CVE, malware family, or threat-actor attribution has been disclosed by any source; the technique is an abuse of legitimate SVG/browser capability and of gateway/filter trust assumptions rather than a specific software vulnerability. ## MITRE ATT&CK - T1566.001 Spearphishing Attachment - T1204.002 Malicious File - T1684.001 Impersonation - T1027 Obfuscated Files or Information - T1027.006 HTML Smuggling - T1071.001 Web Protocols - T1557 Adversary-in-the-Middle - T1539 Steal Web Session Cookie - T1583.001 Domains - T1585.002 Email Accounts - T1608 Stage Capabilities ## Sources - [Fake Voicemail SVG Files Bypass Email Security Filters](https://www.infosecurity-magazine.com/news/fake-voicemail-svg-files-bypass/) - [SVG Smuggling: How a 26,000-Email Phishing Campaign Hid Malware in Image Files](https://www.kaseya.com/blog/svg-smuggling-voicemail-phishing-campaign/) - [The Voicemail You Never Left: SVG Phishing Through a DMARC Failure](https://ironscales.com/threat-intelligence/malicious-svg-attachment-voicemail-lure-dmarc-fail-delivery) - [The Voicemail Attachment That Was Secretly a Script](https://ironscales.com/threat-intelligence/voicemail-svg-attachment-hidden-script-overlay-evasion) - [Hidden in plain sight: How SVGs carry malicious scripts](https://www.reversinglabs.com/blog/how-svgs-carry-dangerous-scripts) - [SVG attachments used in widespread phishing campaign](https://www.scworld.com/brief/svg-attachments-used-in-widespread-phishing-campaign) - [SVG Phishing Email Attachments (Mini-Report 2026)](https://hoxhunt.com/blog/svg-phishing-email-attachments-mini-report) - [SVG Phishing Emails Bypass Email Security: SANS Flags New MIME-Type Evasion](https://www.techtimes.com/articles/317615/20260602/svg-phishing-emails-bypass-email-security-sans-flags-new-mime-type-evasion.htm) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2230