Sk

🚨 𝗦𝗩𝗚 𝗦𝗺𝘂𝗴𝗴𝗹𝗶𝗻𝗴 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗛𝗶𝘁𝘀 𝗖𝗼𝗹𝗼𝗺𝗯𝗶𝗮𝗻 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 We’re seeing a surge in a #phishing campaign targeting government, finance, oil and gas, and healthcare sectors in Colombia ⚠️ Attackers distribute Spanish-language emails with an attached SVG file. The file is not a static image but an active SVG containing embedded JavaScript that uses SVG smuggling to reconstruct the next stage locally via a blob URL, without fetching a payload from external resources. The browser then generates an intermediate HTML lure that mimics document preparation, and from embedded data creates a password-protected ZIP archive for the user to open. ❗️ This kind of attack can blur early-stage visibility for SOC teams. SVG smuggling, blob objects, and legitimate Windows components break the compromise into weak signals, making detection and investigation harder in the early stages. ⚡ #ANYRUN Sandbox allows analysts to quickly reconstruct 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗲𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗰𝗵𝗮𝗶𝗻: SVG smuggling ➡️ Blob-based HTML lure ➡️ Password-protected ZIP ➡️ Notificacion Fiscal.js (launcher / execution handoff) ➡️ radicado.hta (dropper) ➡️ J0Ogv7Hf.ps1 (script-based RAT / Vjw0rm-like implant) ➡️ C2 communication ✅ This helps security teams connect scattered artifacts faster, expose hidden delivery stages, and confirm malicious activity before the attack moves further. 👨‍💻 Learn how #ANYRUN helps detect complex threats faster: any.run/features/?utm_…