Fileless Malware Evasion: Analyzing How PureMiner Uses SVG Vector Graphics for Initial Access and Data Theft

 

 

By CyberDudeBivash • September 29, 2025, 4:05 PM IST • Threat Intelligence Report

 

In the relentless cat-and-mouse game of cybersecurity, attackers are constantly innovating to bypass our defenses. We are now tracking a new, highly evasive campaign that combines two powerful techniques: **fileless malware** and a novel initial access vector using **Scalable Vector Graphics (SVG) images**. The malware, which we have dubbed **PureMiner**, is a sophisticated information stealer that executes entirely in memory, leaving almost no trace on the victim's hard drive. Its name appears to be a deliberate misdirection; its primary goal is not cryptomining, but the exfiltration of credentials and session tokens. This report provides a deep-dive technical analysis of this new threat, detailing the kill chain from a simple image file to a full-scale data breach, and outlines the behavioral detection strategy required to counter it.

 

Disclosure: This is a technical threat report for security practitioners. It contains our full suite of affiliate links to best-in-class solutions for a holistic security posture. Your support helps fund our independent research.

  Executive Summary / TL;DR

For the busy CISO: A new fileless malware campaign, "PureMiner," is using malicious SVG image files to gain initial access. The SVG contains hidden JavaScript that executes in the user's browser, which then launches an in-memory PowerShell payload. The malware's goal is to steal browser credentials and session tokens. Because there is no traditional `.exe` file, legacy antivirus is ineffective. Defense requires a layered approach: **1) A modern Web Application Firewall (WAF)** to scan SVG files for malicious content. **2) An Endpoint Detection and Response (EDR) solution** to detect the anomalous behavior of a browser spawning PowerShell. **3) A Zero Trust architecture** to prevent the compromised machine from accessing critical resources.

Fileless Malware Evasion: Analyzing How PureMiner Uses SVG Vector Graphics for Initial Access and Data Theft

Hey everyone, CyberDude Bivash here, dropping in with another critical deep dive into the evolving threat landscape. Today, we're dissecting a particularly nasty and sophisticated technique employed by a fileless malware strain known as PureMiner. This isn't your grandma's malware; we're talking about advanced evasion tactics that leverage something as seemingly innocuous as an SVG vector graphic for initial access and, ultimately, data theft.

This incident highlights a stark reality: attackers are constantly innovating, finding new ways to bypass traditional defenses. Understanding these techniques is crucial for hardening your defenses in a Zero-Trust world.

The Rise of Fileless Malware

First, a quick refresher: fileless malware operates in memory, avoiding writing malicious files to disk. This makes it incredibly difficult for traditional antivirus solutions, which primarily scan for known malicious file signatures, to detect. It leaves minimal forensic traces, making incident response a nightmare. PureMiner is a prime example of this elusive threat.

PureMiner's Modus Operandi: The SVG Deception

The most alarming aspect of PureMiner's attack chain is its use of SVG (Scalable Vector Graphics) files. Historically, SVGs have been considered relatively safe. They're XML-based, used for displaying graphics, and common across the web. But as we discussed in my previous post, their XML structure allows for embedded scripts and external calls – and that's precisely where PureMiner strikes.

Here's a breakdown of how PureMiner typically orchestrates its initial access and subsequent data theft using SVG:

Step 1: The Lure – Malicious SVG Delivery

The attack often begins with a classic phishing campaign. However, instead of a malicious executable or a macro-enabled document, the victim receives an email or encounters a website that delivers a seemingly legitimate SVG file. This SVG might appear to be an invoice, a notification, or an interesting image.

When the victim opens the SVG in a web browser or an application that renders SVGs, the hidden malicious payload begins its work.

Step 2: Hidden Script Execution within the SVG

Within the SVG's XML structure, PureMiner embeds obfuscated JavaScript. This isn't just simple scripting; it's carefully crafted to:

• Bypass SVG renderers' built-in sanitization: It uses legitimate SVG elements and attributes in unconventional ways to execute arbitrary code.

• Load external resources: The embedded script initiates a connection to a Command and Control (C2) server. This is where the "fileless" aspect truly kicks in. Instead of downloading an executable, it downloads a script or a shellcode directly into memory.

The image shows an abstract, high-tech depiction of an SVG file's code being highlighted, with malicious script elements visibly interwoven into the graphic's structure. On the left, a stylized magnifying glass indicates analysis. On the right, a network diagram with glowing lines suggests the initiation of a connection to a remote server, illustrating the "Hidden Script Execution within the SVG" step of the attack.

Step 3: PowerShell Abuse and In-Memory Payload

Once the C2 connection is established, PureMiner typically leverages legitimate system tools, most notably PowerShell, to download and execute its main payload directly into memory. PowerShell is incredibly versatile and present on almost all Windows systems, making it a favorite tool for attackers.

The PowerShell script will:

• Download the pure-malicious payload: This is often another script (e.g., a heavily obfuscated JScript or more PowerShell) or even a compiled executable that runs entirely in memory.

• Establish persistence: Although fileless, attackers still want to survive reboots. PureMiner might use legitimate registry keys, WMI (Windows Management Instrumentation) events, or scheduled tasks to re-launch its in-memory components upon system startup, all without dropping a traditional executable to disk.

Step 4: Data Theft (and often Crypto-Mining)

With persistent access established, PureMiner proceeds with its primary objectives. While its name suggests crypto-mining (which it often does to generate illicit revenue for the attackers), the initial access via SVG and the fileless nature allow it to pivot to other malicious activities, including:

• Credential Harvesting: Stealing login credentials from browsers, email clients, and system processes.

• Sensitive Data Exfiltration: Searching for and sending documents, intellectual property, and personal data to the C2 server.

• Lateral Movement: Using stolen credentials to move to other systems within the network.

• Backdoor Creation: Establishing additional backdoors for future access.

This multi-stage, fileless approach makes PureMiner incredibly stealthy and resilient.

Defensive Strategies Against PureMiner and Similar Threats

This incident serves as a critical wake-up call. Here's how you can defend against advanced fileless threats like PureMiner:

1. Strict SVG Sanitization (Go Zero-Trust):

   • Deploy an SVG Security Toolkit: As I emphasized in my previous post, use tools to parse and sanitize all incoming SVGs. Strip out all scripts, external references (xlink:href to external domains), and event handlers (on*).

   • Content Security Policy (CSP): For web applications, implement strong CSPs that restrict script execution origins and prevent inline scripts.

2. Advanced Endpoint Detection and Response (EDR):

   • Traditional AV struggles with fileless malware. EDR solutions monitor process behavior, memory activities, and legitimate tool abuse (like PowerShell). They can detect anomalous execution patterns that indicate a fileless attack.

3. PowerShell Logging and Script Block Logging:

   • Enable extensive PowerShell logging, including Script Block Logging and Module Logging. This captures the actual code executed by PowerShell, even if it's run in memory.

   • Forward these logs to your SIEM for analysis and alerting.

4. Application Whitelisting (Principle of Least Privilege):

   • Use solutions like AppLocker or Windows Defender Application Control (WDAC) to restrict what applications can run on your endpoints. Only allow known good executables and scripts. This makes it much harder for malicious PowerShell or other scripts to execute.

5. Network Monitoring and DNS Filtering:

   • Monitor outbound network connections for suspicious C2 traffic. PureMiner still needs to communicate with its C2 server.

   • Implement robust DNS filtering to block connections to known malicious domains.

6. User Education and Phishing Awareness:

   • Regularly train users to identify phishing attempts. Emphasize caution with attachments and links, even if they appear to be benign file types like SVGs.

7. Threat Intelligence:

   • Stay updated on the latest threat intelligence regarding fileless malware, new evasion techniques, and indicators of compromise (IOCs) associated with PureMiner or similar strains.

Conclusion

PureMiner's ingenious use of SVG vector graphics for initial access is a testament to the ever-evolving sophistication of cyber threats. It underscores the importance of moving beyond signature-based detection and embracing a holistic, Zero-Trust security approach that focuses on behavior, strong endpoint controls, and proactive sanitization.

Don't let an innocent-looking graphic bring your defenses down. Stay vigilant, stay updated, and secure your SVG pipelines!

CyberDude Bivash out!