How does phishing via malicious SVG attachments work, and why do email filters let them through?

SVG FILES ARE XML TEXT CODE AND CAN CONTAIN EXECUTABLE JAVASCRIPT SCRIPTS.

Vector images in SVG format are often perceived by email clients and antivirus scanners as regular graphic files. When such an image is opened in a browser, an embedded software script that redirects to a phishing resource launches automatically.

Embedding Executable Scripts in Vector Graphics

The SVG language specification supports adding script tags directly inside the graphic structure of an image. Attackers encrypt malicious code within the file body: when attempting to view the attached document, the browser executes a script that downloads a trojan downloader or generates a password entry form.

Protection Measures Against Hidden Scripts in Graphics

Block the automatic opening of files with the .svg extension via the default web browser
Configure corporate and personal email filters to quarantine vector graphic attachments
Never double-click logos and diagrams in SVG format received from counterparties
Check the source code of the file using a regular text editor for JavaScript tags