While SVG primarily enables the crafting of images using text, lines, and shapes in code rather than pixels, such files could also be utilized to show HTML and facilitate JavaScript execution in credential-stealing phishing forms, with BleepingComputer noting the discovery of an SVG attachment showing a phony Excel spreadsheet with a login form that allowed data exfiltration. Attackers have also used SVG attachments spoofing official information requests that lure targets into downloading malware, as well as other SVG files with images that redirect to phishing forms.

Source: SC Magazine