QBot malware phishing campaigns have adopted a new distribution method using SVG files to perform HTML smuggling that locally creates a malicious installer for Windows.

The SVG uses XOR-encrypted JavaScript, and once viewed in a browser, it decodes and runs a redirect to an actor-controlled final URL with Base64 encoding for victim tracking.

SVG files are XML-based and can contain HTML and JavaScript, which criminals can exploit for malicious purposes.