Voicemail Lures Hide JavaScript in Plain Sight

For two months, cybercriminals quietly slipped malicious files past corporate email defenses by disguising them as voicemail notifications. The twist? The attachments were SVG files — a format most scanners treat as harmless images.

Email security vendor INKY detected 26,589 malicious messages across 5,527 organizations between June 1 and August 4, 2026. The campaign ran in waves, largely pausing on weekends. The biggest spike hit on June 3, when 2,432 messages reached 1,149 companies in a single day.

And it’s still going. INKY noted the operation was active when its analysis closed.

Why SVG Attachments Slip Past Filters

SVG files are vector images, but they can also carry embedded JavaScript. That’s the core of this attack. The attachments declared a MIME type of text/plain instead of image/svg+xml, so scanners checking the stated type saw an innocuous text file rather than executable content.

Inside, a minimal graphic shell hid obfuscated script. The code reconstructed strings at runtime, fetched a remote endpoint, and used deferred execution and runtime script injection. Static analysis tools struggled to flag it because nothing looked suspicious until the browser rendered the file.

The Social Engineering Layer

The lures were personalized. In 99.5% of cases, the email subject included the local part of the recipient’s own address — making the message feel internal. Attachment names mimicked standard voicemail files, complete with XML content to reinforce the illusion.

It’s a classic pretext: a missed call, a voice message, a quick click. The recipient’s guard drops because the email looks like it came from their own company.

Internal Spoofing Carried the Campaign

The operation leaned hard on domain spoofing. INKY found that 95% of messages claimed to originate from the recipient’s own domain, yet they arrived from external senders that had never authenticated to the mail server.

That’s a red flag for trained eyes, but native filters missed it. Microsoft’s Spam Confidence Level (SCL) scoring treated 75% of the messages — 19,994 total — as harmless, assigning them an SCL of 0 or 1. Only 18% received an SCL of 5, which would typically trigger quarantine.

INKY also observed that the same template drew different native verdicts depending on the receiving mailbox. One message could be flagged in one org and waved through in another, exposing the inconsistency of default filtering.

Broad Spray, Not Precision Targeting

This wasn’t a spear-phishing operation. The median organization received just two messages, and 32% received only one. The ten most-affected companies accounted for just 6% of total volume — a clear sign of broad, untargeted delivery.

The attackers cast a wide net, betting that volume would compensate for low individual success rates. They combined several plausible signals: a familiar voicemail pretext, an image format, recipient-specific personalization, and internal sender impersonation.

The SVG attachment was the bridge. It connected social engineering to executable browser content, turning a simple click into a potential infection.

What This Means for Email Security

This campaign shows why relying solely on native spam filters is risky. Attackers are weaponizing file formats that many security stacks overlook. SVG files, in particular, are a growing vector because they’re not typically treated as executable.

Organizations should consider the following:

• Block or sandbox SVG attachments arriving via email, especially from external senders.
• Inspect MIME types rather than trusting declared headers.
• Train employees to verify voicemail notifications through official channels, not email links.
• Deploy email security tools that analyze content behavior, not just static signatures.

For more on how attackers abuse file formats, see our breakdown of phishing email evasion techniques and email spoofing prevention best practices.

The takeaway is simple: if a voicemail notification arrives as an attachment, think twice. Real voicemail systems don’t send SVG files.

White House bans foreign-made power grid equipment over cyber backdoor fears

The Trump administration on Wednesday issued an executive order banning the acquisition of foreign-made technology used to manage electricity and power. The White House said the decision was made because “certain foreign actors are increasingly creating and exploiting vulnerabilities” in the technology — known as bulk-power systems.

The order warns that the equipment powering critical infrastructure may have digital backdoors allowing foreign governments to access equipment remotely or cause supply-chain disruptions.

“During my first term, I found that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense,” President Donald Trump said.

A string of cyberattacks on critical infrastructure

The order follows a string of concerning cyberattacks on critical infrastructure. Water utilities in at least 12 states experienced cyberattacks last month, and on Wednesday, the federal cyber defense agency said it “observed malicious cyber activity targeting over 100 internet-exposed systems” in the water and wastewater sector.

In the United Kingdom, hackers reportedly shut down a small British power plant for four days. The National Security Agency and FBI recently published an advisory about an artificial intelligence-powered “active threat” to a specific brand of operational technology used by the energy, water, and agricultural industries.

While no countries were officially blamed for the incidents, several experts have pointed the finger at Iranian hackers. In addition to Iran, U.S. officials have previously attributed past attacks on critical infrastructure to Russian and Chinese hackers.

The FBI disrupted a Chinese botnet on Wednesday they said was used to breach the Federal Reserve, NASA, and other federal agencies managing critical infrastructure.

‘An unusual and extraordinary threat’

Wednesday’s order focuses on the technology that manages energy transmission lines rated at 69,000 volts or higher, as well as substations, control rooms, power generating stations, reactors, and more. It also covers associated software and firmware that could be remotely accessed or updated by foreign governments.

The order calls foreign-made bulk-power system electric equipment an “unusual and extraordinary threat” and bans the acquisition or installation of the tools in the U.S.

The Defense, Commerce, and Energy Departments are tasked with checking transactions involving bulk-power system electric equipment. Federal agencies can also impose conditions on previously purchased equipment but must consider whether replacements are available.

Implementation and next steps

A list will be created and published outlining pre-qualified equipment and vendors. Senior officials have 120 days to create rules and regulations around the issue and determine which countries “warrant particular scrutiny under the provisions of this order.”

Agencies will also need to identify currently used bulk-power system electric equipment that is considered at risk and submit a plan to the White House about how they plan to “identify, inventory, isolate, monitor, or replace such items as soon as practicable.”

The White House did not respond to requests for comment about what precipitated the executive order.

AI and the evolving threat landscape

Cybersecurity experts and government agencies have repeatedly warned that government-backed hackers are deploying artificial intelligence in attacks on critical infrastructure — simplifying potentially devastating attacks.

After the executive order was published, OpenAI, Google, and dozens of other tech and finance giants issued a warning that there is a “limited window to strengthen cyber defenses” before AI-enabled cyberattacks “will become far more widespread and sophisticated as models around the world become increasingly capable.”

“The companies and public services our communities depend on — from hospitals to water treatment plants to the infrastructure that powers the internet — are at risk,” OpenAI said, warning that security teams for critical infrastructure have been “historically under-resourced.”

The company said governments need to coordinate cyber defense at local, national, and international levels while also sharing actionable threat intelligence.

For more on related threats, check out our coverage of critical infrastructure cyberattacks and AI-powered cyber threats.

A Busy Day for the KEV Catalog

On August 26, the US Cybersecurity and Infrastructure Security Agency (CISA) dropped six new entries into its Known Exploited Vulnerabilities (KEV) catalog in a single day. That’s a hefty batch, even by recent standards. The message is blunt: these aren’t theoretical risks. There’s real-world evidence attackers are using them right now.

The CISA KEV catalog is essentially a watchlist of flaws that have been confirmed as exploited in the wild. Federal agencies are required to patch them by binding operational directives, and CISA strongly urges critical infrastructure operators to do the same. When a vulnerability lands here, the clock starts ticking.

The Citrix NetScaler Memory Overflow at the Top of the List

Two of the six flaws carry a high-severity rating. The first, tracked as CVE-2026-8452, is a memory overflow issue in NetScaler ADC and NetScaler Gateway from Citrix. It was reported back in late June and carries a CVSS score of 8.8.

What can an attacker do with it? If the appliance is set up as a Gateway (think SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, exploitation can trigger unpredictable behavior or a full denial of service (DoS). That’s the kind of outage that gets IT teams called in at 2 a.m.

Citrix has already shipped fixes. The patched versions are:

• NetScaler ADC and NetScaler Gateway 14.1-72.61 and later
• NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later 14.1-FIPS releases
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases

Why This One Matters

NetScaler devices sit at the network edge. They’re the front door for remote workers and VPN traffic. A memory overflow there isn’t just a server problem — it’s a gateway to the whole internal network. If you’re running an unpatched version, the window for fixing this is narrow.

The Seven-Year-Old Microsoft SQL Server RCE That Won’t Die

The second high-severity entry is CVE-2019-1068, a remote code execution (RCE) vulnerability in Microsoft SQL Server. It also scores 8.8 on the CVSS scale. Here’s the uncomfortable part: a patch has been available since 2019. Seven years. And attackers are still finding unpatched systems to hit.

The exploit works by sending a specially crafted query to an affected SQL server. If it lands, the attacker can execute code in the context of the SQL Server Database Engine service account. That’s not a sandbox — that’s a high-privilege position inside your database tier.

For the two high-severity flaws, CISA has set a deadline of August 29. That’s a short window, and it reflects how urgent the agency considers these particular exploits.

The Rest of the Batch: Older Flaws, Real Consequences

The other four entries are all several years old, but age hasn’t made them harmless. CISA has given organizations until September 9 to patch these:

• CVE-2015-3246: A race condition in Red Hat Libuser, rated 5.1. It can lead to privilege escalation or other unauthorized actions.
• CVE-2015-5287: A privilege escalation flaw in Red Hat’s automatic bug reporting tool (ABRT), rated 7.8. Attackers can use it to gain elevated access on affected systems.
• CVE-2021-23758: A deserialization of untrusted data issue in Ajax.NET Professional, rated 8.1. This one can lead to remote code execution in the right conditions.
• CVE-2022-0995: An out-of-bounds write vulnerability in the Linux kernel, rated 7.8. Exploitation can cause system crashes or, worse, arbitrary code execution.

Why Old Vulnerabilities Still Get Exploited

It’s tempting to assume a 2015 or 2019 flaw is ancient history. The reality is different. Attackers scan the internet constantly for signatures of unpatched systems. Legacy software lingers in corners of enterprise networks — that old SQL Server instance nobody remembers, the Linux box running a kernel from three years ago.

The KEV catalog addition doesn’t mean these are new attacks. It means CISA has confirmed they’re ongoing. The agency’s decision to include them signals that real-world exploitation is happening at a scale worth flagging.

What You Should Do Right Now

If you’re running any of these products, the first step is to check your versions against the patched releases. For Citrix NetScaler, verify the exact build. For SQL Server, confirm you’re on a supported version with the latest cumulative update. For Linux and Red Hat components, check with your distribution’s security advisories.

Don’t wait for the deadlines. August 29 for the Citrix and Microsoft flaws, September 9 for the others — these aren’t suggestions. If your organization has ever struggled with patch management best practices, this is the moment to tighten the process.

Also worth reviewing: your vulnerability disclosure and response workflow. The gap between a vendor releasing a patch and your team applying it is exactly the window attackers exploit. Seven years is a long time for a known RCE to stay alive. Don’t let your environment be the reason it keeps going.