Credential Phishing Campaign Targets 7,800+ Organizations via Fake Voicemail Emails

• •Over 7,800 organizations targeted in a phishing campaign using fake voicemail emails.
• •Malicious SVG attachments redirect users to credential-harvesting pages with auto-filled email addresses.
• •Attackers exploit familiarity with automated voicemail notifications to lower user skepticism.

A large-scale phishing campaign has targeted over 7,800 organizations by sending emails that impersonate automated voicemail transcript notifications. Between August 17 and August 31, Check Point identified more than 58,000 phishing emails leveraging over 38,400 spoofed sender addresses across 9,300 spoofed domains. The emails contain malicious SVG attachments that redirect users to credential-harvesting pages. The subject lines of these emails mimic familiar notifications, making them appear legitimate. The SVG files execute JavaScript to auto-fill the victim's email address on the phishing page, enhancing the attack's credibility. Organizations are urged to treat SVGs as active content and verify notifications before acting. This campaign highlights the limitations of traditional email security measures that rely on sender reputation and known malicious links.