SVG smuggling: an infostealer disguised as a court summons

An .svg file doesn’t look like an executable, and that’s exactly the point. In a case we investigated recently, an SVG was the initial infection vector in a social-engineering campaign built around a fake legal threat.

The lure

A phishing email sent from a Gmail account delivered a file named Citacion obligatoria por amenazas, insultos y trato_0FA5B4.svg, Spanish for “mandatory summons for threats, insults and mistreatment,” styled to look like an official legal notice.

Execution chain

1. The victim opens the .svg attachment. SVG is an XML-based format, and XML can carry embedded <script> tags. Most people, and plenty of security tooling, don’t expect an image file to execute JavaScript.
2. The embedded script opens the default browser and redirects to a site imitating a government portal.
3. The fake site serves a download: DEMANDA POR DAÑOS Y PERJUICIOS_BBF259.zip, Spanish for “lawsuit for damages.”
4. Inside the archive, 04 BOLETA JUDICIAL.exe (“court ticket”) acts as a loader.
5. The loader deploys additional components associated with an infostealer.

The standout detail: the file type is the trick

There’s no exploit here and no macro. The entire first stage relies on the fact that .svg reads as “just an image” to a human, and to a lot of automated scanning, while technically being a text-based, script-capable format. Combined with a filename engineered to trigger urgency (a legal threat, in the victim’s own language), it’s a lure built to bypass judgment rather than technical controls.

Indicators of compromise

Lure (SVG)             Citacion obligatoria por amenazas, insultos y trato_0FA5B4.svg
Archive                DEMANDA POR DAÃ_OS Y PERJUCIOS_BBF259.zip (encoding artifact as observed)
Loader                 04 BOLETA JUDICIAL.exe
wblindp2.dll           9852c70d507ffe187069aba3e4edf10eba384de8e4a8f962fb1ecd921184a3b4
SdAppServices.dll      8c335c5a4bb3a950432df16b90735d51c962451fb14ccdf486b5340edfe11b4b
04 BOLETA JUDICIAL.exe 19d78cd26cbfeb0800508063359f149f271fd7904d1ee0983ec24ba9efcb11e5
Crisp.exe              c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
AxisOr.exe             cb26f2f14b0c15180014a6262a8599bd0d8e4a0ef44445ee360725df3d18655e

Takeaways for defenders

• Don’t whitelist a file type just because it “shouldn’t” run code. SVG, like several other XML-based formats, can carry embedded scripts. Attachment filtering that only flags .exe, .js, or macro-enabled Office documents misses it entirely.
• Urgency plus authority is still the most reliable social-engineering lever. A fake legal summons, in the victim’s own language, from an authority they can’t easily verify, works regardless of the technical delivery mechanism behind it.
• Loaders are disposable, track the family behind them. 04 BOLETA JUDICIAL.exe is just the entry point; the actual objective sits in the infostealer components it deploys.