Cybersecurity researchers have found that Scalable Vector Graphics (SVG) attachments are becoming an increasingly popular way for threat actors to deliver malware or send phishing forms while evading detection. SVG files display images via code instead of using pixels, allowing the vector images to automatically resize without losing quality in different resolutions. SVG files have been used before by threat actors, notably to distribute Qbot malware via HTML smuggling. In recent campaigns, researchers have observed SVG files that display HTML and execute JavaScript, crafted to display phishing forms which can send victims’ inputs back to the attacker. SVG attachments can also embed links that when clicked lead to a malware site or use JavaScript to automatically redirect browsers to malicious sites. Due to the nature of SVG files, they can more easily evade detection from security software than other file types. Luckily, SVG files are not commonly used in business, and organizations may choose to block all emails containing an SVG attachment by policy. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.