SVG Phishing Files Are Now the Third Most Common Malicious Email Attachment -- and DMARC Cannot Filter Them

Sat, 20 Jun 2026 08:00:00 +0000

On June 2, 2026, SANS Internet Storm Center handler Xavier Mertens published an analysis of a phishing wave that had been landing in his inbox for several consecutive days. The attachment on each message was an SVG file – a Scalable Vector Graphics image. Each email passed SPF, DKIM, and DMARC checks cleanly. The attachment opened in a browser without any security warning. The malicious payload executed the moment it was clicked.

Svg on Daily DMARC News

SVG Phishing Files Are Now the Third Most Common Malicious Email Attachment -- and DMARC Cannot Filter Them