Threat reportMalwareTL-2026-3909
Colombian SVG-based phishing/dropper campaign impersonating Fiscalía General de la Nación uncovered via AI code analysis
Colombian SVG-based phishing/dropper campaign impersonating (TL-2026-3909) is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Various Web browsers and email clients that render SVG attachments, maps to 22 MITRE ATT&CK techniques (T1027, T1027.006, T1027.016), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-3909
- Threat ID
- TL-2026-3909
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, legal, judiciary, general public
- Target regions
- colombia, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Colombian SVG-based phishing/dropper campaign impersonating
Malware and tooling: AsyncRAT
How Colombian SVG-based phishing/dropper campaign impersonating works
A malware campaign targeting Colombian citizens and institutions delivers email-borne SVG files with embedded JavaScript that render a fake Fiscalía General de la Nación judicial portal and silently drop a Base64-encoded ZIP payload. The SVGs used polymorphism and massive dummy-code padding and initially had zero antivirus detections; VirusTotal Code Insight flagged them and a retrohunt found 523 related samples.
In September 2025 VirusTotal (Bernardo Quintero) described a phishing and malware-distribution campaign aimed at Colombian victims, with the earliest sample submitted from Colombia on 2025-08-14. The lure is an SVG file sent by email. SVG is an XML format, so it can carry HTML through the <foreignObject> element and JavaScript in CDATA sections. When the SVG is rendered in a browser, the script decodes and injects a Base64-encoded HTML page impersonating the Colombian judicial portal of the Fiscalía General de la Nación. The page shows case numbers, security tokens and a fake download progress bar to build trust.
While the victim watches the progress bar, the script decodes a second, large Base64 string containing a ZIP archive and forces its download. BleepingComputer, citing VirusTotal's findings, reports that the ZIP is password-protected, that the password is shown on the fake page, and that it contains four files: a legitimate Comodo Dragon browser executable renamed to look like an official document, a malicious DLL intended for sideloading, and two encrypted files. Reported sample hashes include SVG 4521d694774940dfc545619fb48012ef46238156113f08314dbe33f81dfdb0ff and DLL 82b19747645326479e2068fe08d850e1696e021f39fdf1a71874fe91b71fbee5. The article does not name a final malware family.
The SVGs use code polymorphism, massive dummy/garbage-function padding to inflate entropy, and character-encoding and CDATA obfuscation. Spanish-language code comments such as POLIFORMISMO_MASIVO_SEGURO and Funciones dummy MASIVAS remained in the source and became the basis of a YARA rule. The first cohort was 44 unique SVGs with zero AV detections, and a retrohunt over roughly a year of submissions returned 523 matching samples. Payload size shrank over time from about 25 MB to smaller variants. VirusTotal's Code Insight, newly extended to SVG analysis, described the malicious intent despite the obfuscation. Delivery is by email, and VirusTotal notes pivots on sender addresses, subject lines and attachment names. The article gives no formal actor attribution; Colombian origin and targeting are inferred from the Spanish-language code and lure content.
A related campaign was documented by Seqrite Labs on 2025-10-13. It also uses a Colombian judicial-notification SVG lure (impersonating Juzgado 17 Civil Municipal del Circuito de Bogotá), but with a different chain: SVG, fake page, HTA download, VBS, PowerShell, encoded DLL loader, then an injector that runs AsyncRAT inside MSBuild.exe. Seqrite does not explicitly tie this to the VirusTotal sample set, so it is recorded here as thematically related, probable same-theme tradecraft rather than a confirmed link. The SVG-to-ZIP flow and the SVG-to-HTA-to-AsyncRAT flow should be treated as separate delivery chains until linked by further evidence. Severity MEDIUM is the analyst's estimate; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-3909
Defense Evasion
T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling; T1027.016 Junk Code Insertion; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Collection
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Discovery
Initial Access
Affected products and versions in Colombian SVG-based phishing/dropper campaign impersonating
- Various — Web browsers and email clients that render SVG attachments with active script
Vulnerable versions: Default SVG handling that renders embedded JavaScript - Microsoft — Windows endpoints (DLL sideloading and, in the related chain, HTA/VBS/PowerShell/MSBuild execution)
Vulnerable versions: Not version-specific; behavioral exposure
Remediation for Colombian SVG-based phishing/dropper campaign impersonating
Immediate actions
- Block or quarantine inbound email attachments with .svg extension, or strip/sandbox them at the mail gateway
- Hunt mail logs for SVG attachments impersonating Fiscalía General de la Nación or Colombian court notifications (e.g. 'Juzgado' in filename)
- Run the published YARA rule (strings 'Funciones dummy MASIVAS' / 'POLIFORMISMO_MASIVO_SEGURO') against mail attachments and endpoint file stores
- Block the listed SHA-256 hashes in EDR and search endpoints for password-protected ZIPs containing a renamed Comodo Dragon executable plus a DLL
Workarounds
- Block mshta.exe and wscript.exe execution of downloaded .hta/.vbs files via application control or ASR rules (related AsyncRAT chain)
- Block outbound access to paste/text hosting services from servers and non-developer endpoints where not needed
Longer-term hardening
- Change the default handler for .svg files so they open in an image viewer or text editor, not a browser
- Deploy EDR with behavioral detection for DLL sideloading and MSBuild.exe injection
- Train users in Colombian government and legal sectors to treat judicial notifications that offer password-protected downloads as suspicious
- Use AI-assisted or behavioral code analysis for script-bearing file formats, since signature AV missed these samples
Timeline of Colombian SVG-based phishing/dropper campaign impersonating
- Earliest SVG samples of the campaign are submitted to VirusTotal from Colombia, with zero antivirus detections.
- VirusTotal reports that its Code Insight, newly extended to SVG analysis, surfaced 44 unique undetected SVGs through the query type:svg AND codeinsight:"Colombian"; a YARA retrohunt on the Spanish code comments then matched 523 samples across roughly a year of submissions.
- VirusTotal publishes 'Uncovering a Colombian Malware Campaign with AI Code Analysis'. Code Insight flags an undetected SVG that injects a fake Fiscalía General de la Nación portal and drops a Base64 ZIP; a retrohunt finds 523 related samples (44 in the initial cohort).
- Security Affairs and Cybersecurity News report the campaign and publish the YARA rule keyed on 'POLIFORMISMO_MASIVO_SEGURO' and 'Funciones dummy MASIVAS'.
- SC Media briefs on the undetected SVG campaign, noting that signature-based antivirus missed the script-bearing SVG files.
- BleepingComputer reports the payload as a password-protected ZIP with a renamed Comodo Dragon executable, a sideloaded DLL and two encrypted files, and lists SVG and DLL hashes.
- Seqrite/Quick Heal publish detections for the related chain (Trojan.InjectorCiR, Html.Asyncrat.49974.GC, Backdoor.MsilFC.S13564499) and map it to T1566.001, T1055, T1497, T1573 and T1105.
- Seqrite Labs documents a related Colombian judicial-notification SVG campaign delivering AsyncRAT through an HTA/VBS/PowerShell chain and MSBuild.exe injection.
Sources cited for Colombian SVG-based phishing/dropper campaign impersonating
- Uncovering a Colombian Malware Campaign with AI Code Analysis (VirusTotal, Bernardo Quintero)
- SVG files used in hidden malware campaign impersonating Colombian authorities (Security Affairs)
- VirusTotal finds hidden malware phishing campaign in SVG files (BleepingComputer)
- Colombian Malware Weaponizing SWF and SVG to Bypass Detection (Cybersecurity News)
- Judicial Notification Phish in Colombia: SVG delivers AsyncRAT (Seqrite Labs)
- Cybersecurity implications of undetected SVG malware campaign uncovered by VirusTotal (SC Media)
Detection coverage for TL-2026-3909
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3909 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.