# Colombian SVG-based phishing/dropper campaign impersonating Fiscalía General de la Nación uncovered via AI code analysis

> A malware campaign targeting Colombian citizens and institutions delivers email-borne SVG files with embedded JavaScript that render a fake Fiscalía General de la Nación judicial portal and silently drop a Base64-encoded ZIP payload. The SVGs used polymorphism and massive dummy-code padding and initially had zero antivirus detections; VirusTotal Code Insight flagged them and a retrohunt found 523 related samples.

- **Published:** 2026-10-19T18:23:39Z
- **Last reviewed:** 2026-10-19T18:23:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3909
- **ID:** TL-2026-3909
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In September 2025 VirusTotal (Bernardo Quintero) described a phishing and malware-distribution campaign aimed at Colombian victims, with the earliest sample submitted from Colombia on 2025-08-14. The lure is an SVG file sent by email. SVG is an XML format, so it can carry HTML through the <foreignObject> element and JavaScript in CDATA sections. When the SVG is rendered in a browser, the script decodes and injects a Base64-encoded HTML page impersonating the Colombian judicial portal of the Fiscalía General de la Nación. The page shows case numbers, security tokens and a fake download progress bar to build trust.

While the victim watches the progress bar, the script decodes a second, large Base64 string containing a ZIP archive and forces its download. BleepingComputer, citing VirusTotal's findings, reports that the ZIP is password-protected, that the password is shown on the fake page, and that it contains four files: a legitimate Comodo Dragon browser executable renamed to look like an official document, a malicious DLL intended for sideloading, and two encrypted files. Reported sample hashes include SVG 4521d694774940dfc545619fb48012ef46238156113f08314dbe33f81dfdb0ff and DLL 82b19747645326479e2068fe08d850e1696e021f39fdf1a71874fe91b71fbee5. The article does not name a final malware family.

The SVGs use code polymorphism, massive dummy/garbage-function padding to inflate entropy, and character-encoding and CDATA obfuscation. Spanish-language code comments such as POLIFORMISMO_MASIVO_SEGURO and Funciones dummy MASIVAS remained in the source and became the basis of a YARA rule. The first cohort was 44 unique SVGs with zero AV detections, and a retrohunt over roughly a year of submissions returned 523 matching samples. Payload size shrank over time from about 25 MB to smaller variants. VirusTotal's Code Insight, newly extended to SVG analysis, described the malicious intent despite the obfuscation. Delivery is by email, and VirusTotal notes pivots on sender addresses, subject lines and attachment names. The article gives no formal actor attribution; Colombian origin and targeting are inferred from the Spanish-language code and lure content.

A related campaign was documented by Seqrite Labs on 2025-10-13. It also uses a Colombian judicial-notification SVG lure (impersonating Juzgado 17 Civil Municipal del Circuito de Bogotá), but with a different chain: SVG, fake page, HTA download, VBS, PowerShell, encoded DLL loader, then an injector that runs AsyncRAT inside MSBuild.exe. Seqrite does not explicitly tie this to the VirusTotal sample set, so it is recorded here as thematically related, probable same-theme tradecraft rather than a confirmed link. The SVG-to-ZIP flow and the SVG-to-HTA-to-AsyncRAT flow should be treated as separate delivery chains until linked by further evidence. Severity MEDIUM is the analyst's estimate; no CVE or CVSS applies.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1027.006 HTML Smuggling
- T1027.016 Junk Code Insertion
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1574.001 DLL
- T1218.005 Mshta
- T1055 Process Injection
- T1497 Virtualization/Sandbox Evasion
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1497.001 System Checks
- T1056.001 Keylogging
- T1071 Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [Uncovering a Colombian Malware Campaign with AI Code Analysis (VirusTotal, Bernardo Quintero)](https://blog.virustotal.com/2025/09/uncovering-colombian-malware-campaign.html)
- [SVG files used in hidden malware campaign impersonating Colombian authorities (Security Affairs)](https://securityaffairs.com/181917/malware/svg-files-used-in-hidden-malware-campaign-impersonating-colombian-authorities.html)
- [VirusTotal finds hidden malware phishing campaign in SVG files (BleepingComputer)](https://bleepingcomputer.com/news/security/virustotal-finds-hidden-malware-phishing-campaign-in-svg-files)
- [Colombian Malware Weaponizing SWF and SVG to Bypass Detection (Cybersecurity News)](https://cybersecuritynews.com/colombian-malware-weaponizing-swf-and-svg)
- [Judicial Notification Phish in Colombia: SVG delivers AsyncRAT (Seqrite Labs)](https://www.seqrite.com/blog/judicial-notification-phish-colombia-svg-asyncrat/)
- [Cybersecurity implications of undetected SVG malware campaign uncovered by VirusTotal (SC Media)](https://www.scworld.com/brief/cybersecurity-implications-of-undetected-svg-malware-campaign-uncovered-by-virustotal)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3909