Historical intelligence backfill. This assessment covers reporting originally published on 2025-09-24 and was added to the RWP archive on 2026-09-07.
The SVG phishing that looked like an LLM still died on mail-flow and infrastructure tells
Microsoft blocked a limited credential-phishing wave that hid JavaScript in a business-themed SVG, then used Security Copilot to argue the obfuscation was synthetic.
Bottom line up front
CONFIRMED On 24 September 2025 Microsoft Threat Intelligence described a limited credential-phishing campaign that hid its payload in an SVG file dressed up as a business dashboard and named like a PDF. Microsoft assesses the obfuscation as likely LLM-generated. Defender for Office 365 still blocked it using infrastructure, behavior, and message-context signals that the model did not rewrite: self-addressed mail with BCC targets, odd attachment type, redirect to a known-bad domain, fingerprinting on the phish page.
This is not evidence that "AI phishing" is undetectable. It is evidence that payload obfuscation is the wrong layer to bet the SOC on. Historical backfill of reporting published 24 September 2025; added 7 September 2026.
What happened
Microsoft's researchers found an SVG attachment whose internal code used dense business terminology and a verbose, modular structure. Security Copilot, asked whether a human would write that from scratch, called out complexity, verbosity, and lack of practical utility — classic LLM residue: long identifiers, boilerplate comments, formulaic obfuscation, XML declaration plus CDATA.
Independent coverage (Help Net Security, TechRadar, SecurityBrief) matches the mechanics: SVG pretending to be a PDF, US-centric targeting, compromised small-business mailbox sending mail to itself and hiding real recipients in BCC.
Microsoft says the campaign was limited and blocked. That is a vendor-observed scope, not a census of every copycat.
Why it mattered
Two defender myths needed killing in late 2025:
- "If the HTML/SVG is novel, static signatures lose." True for the file. False for the campaign. Mail authentication, graph of who mailed whom, attachment-type policy, and destination reputation still fire.
- "LLM obfuscation is more professional, therefore harder." Microsoft's own analysis says the opposite can happen: synthetic code is noisier. Verbose names and unused scaffolding are a detection feature if you look for them.
The useful 2025 lesson is not "buy an AI detector for attachments." It is "stop letting SVG and HTML execute in the mail client, and stop treating Microsoft-looking file names as a trust signal."
Who / what was affected
REPORTED US organizations, limited volume, credential phishing (not ransomware drop). Exact victim count: UNKNOWN. Actor name: UNKNOWN. Microsoft did not publish a Storm cluster for this specific wave in the pieces we corroborated.
Anyone who still allows SVG/HTML attachments from the internet, or who trains users that "PDF icon" means PDF, is in the blast radius of the next variant.
Technical context
SVG is XML plus optional script. That is an application platform in a file extension people do not associate with macros. Pair it with:
- BCC-hidden targeting from a compromised tenant (looks like internal or self-mail)
- Redirect to a credential kit
- Browser fingerprinting / session tracking on the landing page
and you have a complete AiTM-adjacent phish without a Word macro.
RWP is not reproducing the SVG body or the Copilot prompt Microsoft used.
Exploitation / threat status at the time
CONFIRMED Microsoft blocked the campaign; public blog 24 September 2025; activity described as observed in August in some secondary coverage.
ASSESSED (moderate): LLM assistance on the obfuscation layer. That is Microsoft's assessment, not a cryptographic proof of which model.
UNKNOWN whether the same kit operators reused the pattern after the blog.
This is commodity credential theft tradecraft with a new wrapper, not a nation-state implant story.
What defenders should have done
- Block or sandbox SVG, HTML, and ISO from the internet at the mail gateway. If a business process truly needs SVG, allow-list senders.
- Alert on self-addressed messages with BCC recipient sets and on SVG/HTML named
*.pdf. - Hunt redirects from mail to newly registered or previously tagged phishing domains; do not wait to "read the SVG."
- Phishing-resistant MFA and token/session controls so a captured password is not a captured mailbox.
- Do not staff a project to "detect LLM code." Staff attachment policy and identity.
What we know now
Later 2025–2026 Microsoft reporting (Teams abuse, Tycoon2FA-class kits, payroll pirate AiTM) is the same identity war with better lures. This SVG wave is an early, small exhibit of attackers using models as a content mill, not as an autonomous operator.
RWP assessment
Confidence: High that the campaign existed and was blocked on non-payload signals. Moderate that the SVG was LLM-assisted. Low on prevalence outside Microsoft's telescope.
If your email security story is "we inspect scripts," an LLM will keep generating new scripts. If your story is "SVG from the internet does not run, and sessions are phishing-resistant," the generator is unemployed.
Defensive actions
- Attachment-type policy this week, not an AI-procurement cycle.
- Identity: FIDO2/passkeys for anyone who can see payroll, finance, or admin.
- SOC detection: BCC-heavy self-mail + non-PDF named as PDF.
- User reporting still helps; the tell is "dashboard image that is actually a file you should not open."
Sources
- Microsoft Threat Intelligence — AI vs. AI: Detecting an AI-obfuscated phishing campaign
- Help Net Security — Microsoft spots LLM-obfuscated phishing attack
- TechRadar — Microsoft thwarted phishing campaign after detecting AI-generated code inside malicious attachments
- Microsoft Threat Intelligence — X post on the campaign