Microsoft recently highlighted a new phishing campaign targeting U.S.-based organizations, utilizing code generated using large language models (LLMs) to evade security defenses. The campaign, detected on August 28, 2025, showcases threat actors incorporating artificial intelligence (AI) tools to craft convincing phishing lures and automate malware obfuscation. In this attack, compromised business email accounts were used to send phishing messages disguised as file-sharing notifications, with the actual targets hidden in the BCC field to bypass detection heuristics.
The attackers employed Scalable Vector Graphics (SVG) files to deliver interactive phishing payloads, embedding JavaScript and dynamic content within the files to appear benign to users and security tools. The SVG file format’s support for invisible elements and delayed script execution allows adversaries to sidestep static analysis and sandboxing. The phishing messages used self-addressed email tactics and business-related language to deceive recipients into opening the SVG files, redirecting them to fake login pages to harvest credentials.
Microsoft’s analysis revealed that the SVG files in this campaign were obfuscated using business-related terms, indicating possible generation using an LLM. The payload’s core functionality was obscured with a sequence of business terms, redirecting users to phishing landing pages, triggering browser fingerprinting, and initiating session tracking. The complexity and verbosity of the code suggested it was not human-written, leading to the conclusion that similar techniques are being adopted by various threat actors.
In a separate attack sequence detailed by Forcepoint, phishing emails with .XLAM attachments were used to execute shellcode deploying XWorm RAT through secondary payloads. The multi-stage attack involved loading heavily obfuscated .DLL files in memory, maintaining persistence, and exfiltrating data to command-and-control servers related to the XWorm family. Recent phishing attacks have also utilized lures related to the U.S. Social Security Administration and copyright infringement to distribute information stealers like Lone None Stealer and PureLogs Stealer, demonstrating evolving complexity and novel delivery methods.
Source link