Microsoft Threat Intelligence detected and blocked a credential phishing campaign on August 18, that used AI-generated code disguised as a business performance dashboard within an SVG file. The attack targeted US-based organizations using a self-addressed email tactic and concealed its payload using business terminology.
The Anatomy of an AI-Obfuscated SVG Phishing Campaign
The threat discovered by Microsoft Threat Intelligence began when attackers leveraged a compromised small business email account to distribute malicious emails designed to steal credentials. Attackers employed a self-addressed email tactic where sender and recipient addresses matched, hiding actual targets in the BCC field to bypass basic detection heuristics. The emails were crafted to resemble file-sharing notifications with the message content shown in the campaign examples.
Attached to each message was a file named 23mb – PDF- 6 pages.svg. While the filename suggested a PDF document, the actual file extension indicated an SVG. Scalable Vector Graphics files are attractive to attackers because they are text-based and scriptable, allowing malicious actors to embed JavaScript and other dynamic content directly within the file structure. This enables interactive phishing payloads that appear benign to unsuspecting users and security tools alike, supporting obfuscation features such as invisible elements, encoded attributes, and delayed script execution designed to evade static analysis and sandboxing.
Decoys and Business Terminology in Code
When opened, the SVG file redirected the user to a webpage prompting them to complete a CAPTCHA for security verification—a social engineering tactic used to build trust and delay suspicion. Although visibility into the incident was limited to the initial landing page because security systems blocked the activity, the campaign likely would have presented a fake sign-in page after the CAPTCHA to harvest credentials.
An analysis of the SVG code revealed a unique method of obfuscating content and behavior without relying on traditional cryptographic techniques. Instead, the code used business-related language in two distinct ways. First, the beginning of the SVG code was structured to look like a legitimate business analytics dashboard containing elements for a supposed Business Performance Dashboard, complete with chart bars and month labels. These elements were rendered completely invisible by setting their opacity to zero and their fill to transparent, acting as a decoy to mislead anyone casually inspecting the file. Second, the payload’s actual functionality was hidden using a creative deployment of business terms encoded in a long sequence.
Analyzing the malicious file, Microsoft Security Copilot assessed that the code was not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility. This complexity pointed directly toward the use of a large language model to generate the obfuscation.
The Broader Landscape of AI-Driven Threats
The August 18 incident highlights a shifting digital security landscape where artificial intelligence is adopted by both defenders and cybercriminals. While defenders utilize AI to detect, analyze, and respond to threats at scale, attackers experiment with AI to enhance their operations by crafting more convincing lures, automating obfuscation, and generating code that mimics legitimate content. Even though this particular campaign was limited in nature and primarily aimed at US-based organizations, it exemplifies a broader trend of threat actors leveraging AI to increase operational effectiveness and stealth.
Despite the sophistication of the code, the campaign was successfully detected and blocked by Microsoft Defender for Office 365’s AI-powered protection systems. These systems analyze signals across infrastructure, behavior, and message context that remain largely unaffected by an attacker’s use of AI. Security analysts note that an attacker’s use of AI often introduces new artifacts that can be leveraged for detection, proving that AI-enhanced threats are evolving but not undetectable.
The Parallel Challenges of AI Text Detection
The challenges of identifying AI-generated artifacts extend beyond malicious code into textual content across the broader internet. In digital forensics—a young field devoted to identifying the telltale presence of AI the way detectives scour crime scenes for DNA—experts grapple with rapidly maturing generative models. Dr. Hany Farid, a professor of computer science at Dartmouth who founded the deepfake-detection company GetReal on the very same day ChatGPT was publicly released in November 2022, noted the rapid evolution of synthetic media.
“Generative AI is growing up very, very quickly,” Farid told me. “And it is being weaponized.”
Photo: Gizmodo
Dr. Hany Farid, Professor of Computer Science at Dartmouth
Text detection remains arguably the most difficult form of AI-generated content to identify, as its underlying statistical patterns are much simpler than those required to create photorealistic images or videos. Platforms like Pangram, founded by Stanford graduates in 2023, claim high accuracy rates in flagging AI-generated text, and an independent study from the University of Chicago comparing multiple AI-detection tools found Pangram to be the most effective. However, Max Spero, the company’s CEO and one of its cofounders, noted that detection tools are doomed to forever play catch-up with generative models themselves.
“I don’t think we’ll ever get to one hundred percent accuracy,” Spero told me. The best that the company can do, he adds, is “accumulate more certainty using more data.”
Max Spero, CEO and cofounder of Pangram
Probabilities and Moving Targets in Detection
Other industry leaders share this perspective on the probabilistic nature of detection software. Jon Gillham, CEO of AI detection tool Originality.ai, argued that determining whether text has been generated by AI is analogous to predicting the weather. While an algorithm might indicate a strong statistical likelihood, confident predictions do not always pan out, making detection highly accurate, not perfect… and I’d bet on that continuing to be true in the future, as Gillham described to Gizmodo.
Photo: microsoft.com
Capabilities of large language models like ChatGPT, Claude, Gemini, and Grok constantly evolve as they consume more data, and companies behind them regularly work to eradicate recurring themes or formatting markers once users identify them. Markers such as em dashes become obsolete almost as quickly as detection tools adapt to spot them, creating a perpetual cycle where detection tools also contend with humanizers—websites designed to rework AI text to look more convincingly human. As developers and defenders look ahead, both code obfuscation and text generation remain shifting targets that require continuous adaptation across the security community.
