SVG Voicemail Phishing Hit 5,527 Orgs, Beat Microsoft Filters

A voicemail notification is the most boring email in a corporate inbox, which is exactly why someone built a two month campaign around one. Between June 1 and August 4, 2026, 26,589 of them landed at 5,527 organizations, each carrying an SVG attachment that was never an image at all. INKY, the email security arm of Kaseya, published its analysis of the campaign on August 27. The alarming number in it is not the volume. It is that Microsoft's own filtering scored three quarters of the messages as not spam.

Key Takeaways

• INKY detected 26,589 phishing emails across 5,527 organizations between June 1 and August 4, 2026, each carrying an SVG attachment posing as a voicemail recording.
• The attachments declared a MIME type of text/plain rather than image/svg+xml, so scanners that route files by declared type never sent them to an image or script analyzer.
• Microsoft assigned 19,994 messages (75%) a Spam Confidence Level of 0 or 1, its scores for "not spam", and only 18% reached SCL 5.
• 95% of the messages claimed to come from the recipient's own domain while arriving from an external sender that had never authenticated to that organization's mail server.
• The obfuscated JavaScript inside each SVG assembled its credential harvest page in the browser at runtime, so there was no malicious URL in the message for a gateway to reputation check at delivery.

What Was the SVG Voicemail Campaign?

A broad, unglamorous credential harvesting spray that ran in waves for two months and stopped every weekend. Infosecurity Magazine reported the largest single spike on June 3, when 2,432 messages reached 1,149 organizations in a day, with a resurgence in late July.

The distribution tells you what kind of operation this was. The median organization received two messages. Thirty two percent received exactly one. The ten most targeted organizations together accounted for only 6% of the volume, as SC Media noted in its brief. Nobody was researching your org chart. This was a mail merge.

Plausibility was the one thing they invested in. Sending clustered Monday through Thursday and dropped to near zero at weekends, so the alert landed when a real phone system would have produced one, and 99.5% of subject lines carried the recipient's own email local part, producing lines like "mCaller left Jsmith".

Why Can an SVG File Run Code at All?

Because SVG is not an image format in the way PNG and JPEG are. It is an XML document that the browser parses rather than decodes, and the W3C SVG specification defines a script element inside it. A PNG has no place to put a function. An SVG has a standards blessed one.

INKY's teardown of the payload reads like a checklist of static analysis evasion:

• Semantically empty identifiers. Function and variable names such as intronGap91 and riboUnit30, chosen to look like generated code rather than malware.
• Strings built at runtime. Sensitive literals reconstructed with String.fromCharCode(), so a grep for a domain or a form field name finds nothing.
• Runtime script injection. document.createElementNS() writes the real logic into the DOM only after the file is already open.
• Deferred execution. requestIdleCallback and setTimeout push the payload past the window a sandbox typically watches.

The consequence matters more than any individual trick. Because the credential page is assembled locally in your browser, the email carries no malicious URL, so every gateway control built on reputation checking links at delivery has nothing to check. The launcher travels clean.

How Did One Content-Type Line Beat the Scanners?

The attachments declared themselves as text/plain instead of image/svg+xml, and a scanning pipeline that dispatches files by declared type sent them down the path reserved for harmless text. No image handler. No script analysis. A file extension of .svg sitting next to a header saying "this is a text file", and the header won.

Here is the part that should keep architects awake, because it is not really about SVG. The weakness sits in the routing decision, not the format, and the attacker picks both halves of the mismatch. Any pipeline that trusts a sender supplied Content-Type instead of sniffing the actual bytes inherits the identical bypass, whether the payload is SVG, HTML or a polyglot archive. SVG is simply the format paying best right now: KnowBe4 measured a 245% increase in SVG files used to obfuscate phishing payloads, and Microsoft tracked a separate February 2026 campaign that pushed roughly 1.2 million SVG phishing messages to more than 53,000 organizations.

Why Did Microsoft Score 75% of These as Not Spam?

Because the visible message gave the content filter nothing to object to, and the objectionable part was inside an attachment the filter had already classified as plain text.

Microsoft's Spam Confidence Level documentation defines SCL 0 and 1 as not spam, meaning normal delivery to the inbox. 19,994 of these messages got that treatment, and only 4,777 were stamped SCL 5. Against the org count that is roughly 3.6 messages per organization arriving scored as legitimate mail, in front of a human, with a subject line carrying that human's own name.

A related sample analyzed by IronScales makes the gap starker. That message returned SPF none, DKIM none and a DMARC fail with a quarantine disposition, and Microsoft 365 still handed it SCL -1, the score that skips content filtering entirely. The reason was the relay: the mail was routed through SparkPost, a legitimate bulk sending platform whose reputation carried the message the rest of the way. Authentication said no and reputation said yes, and reputation won.

What Does the DMARC Failure Actually Prove?

That publishing a DMARC record and enforcing one are different projects, and the gap between them is where 95% of this campaign lived.

RFC 7489 defines the policy field as a request to the receiver, not an instruction. A domain at p=none is running telemetry, and a p=quarantine the receiving platform treats as advisory is barely better. The campaign leaned on exactly that gap: mail from yourself, that you did not send, delivered because the alignment failure was logged rather than acted on.

What Should Defenders Do This Week?

Four changes, ordered by how much of this campaign each one removes:

• Treat inbound SVG as active content, not as an image. Block it at the gateway or detonate it in a sandbox that waits out a deferred timer. Almost no business workflow depends on receiving an SVG by email, which makes this an unusually cheap block.
• Alert on declared type versus real content. A .svg extension arriving as text/plain is one high fidelity rule that also catches the next format this technique migrates to.
• Move internal looking senders to enforced rejection. An external message asserting your own domain should not survive an alignment failure, whatever the relay's reputation.
• Deploy phishing resistant MFA so a harvested password is worth less. CISA's guidance on phishing resistant MFA is blunt about why push notifications and one time codes are not enough against an adversary in the middle proxy.

Note what is missing from that list: file hashes. Code that rebuilds its strings at runtime produces a different artifact per message, so detection has to sit at the behavior rather than the sample, the same lesson as SynkLoader's fake Windows lock screen.

What This Means for Your Inbox

Every awareness program trains one instinct: check the link before you click. This campaign defeats it by construction, because there is no link to check. You glance at an attachment carrying an extension you have seen a thousand times on a logo, and open it. Everything hostile happens after that.

Set this next to what has crossed our desk in the last month and a pattern comes into focus. Payroll Pirates hijacked M365 sessions through an adversary in the middle portal. NovaCookies rode genuine Docusign notifications to steal session tokens. This one smuggles a launcher through an attachment. Three unrelated delivery mechanisms in four weeks, all converging on the same endgame: a Microsoft 365 session that is not yours anymore. The delivery layer is where the innovation is happening, and the destination has stopped changing.

The practical guidance for an individual is narrow but real. A voicemail from your own phone system does not arrive as an attachment you have to open in a browser. If your organization uses Teams or a hosted PBX, you already know what its notifications look like, and a file named Voicemail_vRecording_118sec.svg is not one of them. Report it rather than opening it to check, because with this family, opening it to check is the attack.