Case microsoft-llm-svg-phishingAI phishingUnited States
Microsoft blocks phishing campaign using LLM-generated obfuscated SVG files
Microsoft Threat Intelligence detected credential phishing using SVG attachments posing as PDFs whose verbose obfuscated code was likely written by an LLM.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 24, 2025
- Location
- United States
- Target
- US organizations
- Severity
- Medium
- Triggered by
- Unknown credential-phishing operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft Threat Intelligence detected credential phishing using SVG attachments posing as PDFs whose verbose obfuscated code was likely written by an LLM.
Impact: Campaign blocked by Defender for Office 365; limited to US organisations; no confirmed credential compromises reported
Who triggered it
Actor: Unknown credential-phishing operators
Attribution: No public attribution; Microsoft Threat Intelligence assessed the code was likely LLM-generated using Security Copilot
Motive: Credential theft (phishing for account logins)
How it happened
Attack vector: Self-addressed emails from a compromised business account carrying SVG files posing as PDFs; hidden business-term attributes decoded by JavaScript redirect to a fake CAPTCHA and login page
Root cause: SVG files can carry executable script and evade PDF-focused filters; LLM-generated obfuscation masked the payload from signature-based detection
Timeline
- Microsoft Defender for Office 365 detects and blocks the SVG phishing campaign
- Microsoft publishes 'AI vs AI' analysis of the campaign
Response
Microsoft blocked the campaign, published indicators and detection guidance, and used Security Copilot to characterise the AI-generated code
Current status: Contained
Sources (open in a new tab)
- SecurityBrief UK securitybrief.co.uk
- Microsoft Security Blog microsoft.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
Microsoft blocks phishing campaign using LLM-generated obfuscated SVG files. AI Threat Watch, case microsoft-llm-svg-phishing, Sep 24, 2025. https://aithreat.io/cases/microsoft-llm-svg-phishing/
Permanent link: https://aithreat.io/cases/microsoft-llm-svg-phishing/