HPR4406: SVG Files: Cyber Threat Hidden in Images
Hosted by ko3moc on 2025-06-23 01:00:00This show has been flagged as Clean by the host.
Out of nowhere, my Firefox browser on my Mac mini started automatically adding every page I visited to my bookmarks. At first, I thought it was a bug after recent update —maybe a misconfigured setting or similar. But when I searched for a fix, Google suggested something alarming: Scan for malware. And guess what? The source of my trouble turned out to be an 4 SVG files hiding malicious code.
That’s right—those innocent-looking vector graphics files we use every day for logos, icons, and web design? They can secretly carry malware. In my case those were the files, a logos of reputable delivery companies like deliveroo and JustEat which I have downloaded while I was updating a website for my client. Today, we’re breaking down how SVG files are being weaponized, why they’re so effective, and how to protect yourself.
<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg" width="120" height="160" viewBox="0 0 120 160">
<!-- Animated Bodhi Leaf -->
<path id="bodhi-leaf" d="M60 10 Q30 40 20 80 Q15 120 60 150 Q105 120 100 80 Q90 40 60 10 Z" stroke="#1E5631" stroke-width="2">
<animate attributeName="fill" values="white;#FFD700;#2E8B57;#4682B4;#FF0000;#800080;#808080;black;white" dur="8s" repeatCount="indefinite"/>
</path>
<!-- Static veins (contrast with leaf) -->
<path d="M60 10 L60 150" stroke="#1E5631" stroke-width="1.5"/>
<g stroke="#1E5631" stroke-width="1">
<path d="M60 30 Q45 35 40 50"/>
<path d="M60 30 Q75 35 80 50"/>
<path d="M60 60 Q40 70 35 90"/>
<path d="M60 60 Q80 70 85 90"/>
<path d="M60 90 Q50 100 45 120"/>
<path d="M60 90 Q70 100 75 120"/>
</g>
</svg>
HPR Comments
ko3moc says: response
RE: hpr4406::2025-06-23 SVG Files: Cyber Threat Hidden in Images by ko3moc00:08:25 Listen in ogg, opus, or mp3 format.
Yes, it can be steganography if the code is hidden or disguised to avoid detection but if it’s just inserted as active code, it may be looked at as malware or script injection, not steganography as malicious content is clearly visible in the file structure (e.g. have it's own script tag)
oxo says: Interesting!
RE: hpr4406::2025-06-23 SVG Files: Cyber Threat Hidden in Images by ko3moc00:08:25 Listen in ogg, opus, or mp3 format.
Hi ko3moc,
Interesting podcast. Thank you for sharing your knowledge about this. I wondered: is this also categorized as steganography? I guess it is and then used in a malicious way.
My tip as a protonmail user: in my webmail I have automatic downloading of remote content switched off.
Mastodon Comments
More Information...
Copyright Information
Unless otherwise stated, our shows are released under a Creative Commons Attribution-ShareAlike 3.0 Unported (CC BY-SA 3.0) license.
The HPR Website Design is released to the Public Domain.