Kaspersky’s research team has identified a growing trend where threat actors embed malicious code in file formats that are rarely inspected by conventional security solutions. The study highlights a range of "exotic" containers – from ISO disk images and XLL Excel add‑ins to SVG vector graphics and polyglot files that masquerade as legitimate documents. By exploiting the fact that many anti‑virus engines focus on well‑known extensions like .exe, .docx or .pdf, attackers can deliver payloads that remain invisible until the user opens the attachment or the file is mounted on a system.
Real‑world campaigns cited by Kaspersky illustrate the danger. In one case, a phishing email carried an ISO image that, when mounted, automatically launched a ransomware dropper hidden in the disc’s hidden folder. Another operation used a malicious XLL file – an Excel add‑in – to execute PowerShell commands that downloaded a banking trojan. SVG files, which are normally used for scalable graphics, were weaponised with embedded JavaScript that triggered drive‑by downloads when rendered in a webmail client. The most sophisticated examples involved polyglot files that behaved simultaneously as a PDF and a Windows executable, confusing signature‑based scanners that only parsed one format. These techniques expose a blind spot in many corporate email gateways and endpoint protection products that do not fully unpack or analyse the inner structure of such containers.
ALSO READ | Apple’s First Foldable iPhone Duo Set for Tonight’s Launch with Leaked Color Lineup and Pricing
Kaspersky advises security vendors to broaden their inspection capabilities to include these less common formats and to adopt behavior‑based detection that watches for suspicious actions regardless of file type. The firm also recommends regular updates to signature databases, sandboxing of attachments, and user awareness training to discourage opening unexpected files, especially from unknown senders.
