{"id":30839,"date":"2026-08-28T13:12:19","date_gmt":"2026-08-28T17:12:19","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/exotic-file-formats-detection-gaps-iso-one-xll-svg\/30839\/"},"modified":"2026-08-28T18:33:45","modified_gmt":"2026-08-28T17:33:45","slug":"exotic-file-formats-detection-gaps-iso-one-xll-svg","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/exotic-file-formats-detection-gaps-iso-one-xll-svg\/30839\/","title":{"rendered":"Exotic files: unexpected sources of cyberthreats"},"content":{"rendered":"

Threat actors are constantly developing new attack schemes \u2014 from OAuth token theft<\/a> to attacks on AI agents<\/a> \u2014 but the classics never quite leave their playbook. On any given day, an employee may receive malware attached directly to an email, or lying in wait behind a link embedded in an email. Making these attacks succeed still requires a degree of creativity, and in recent years attackers have increasingly adopted exotic file formats. Users don\u2019t perceive these formats as dangerous; more importantly, many EDR and email security solutions skip scanning them entirely. Yet they\u2019ve proven highly effective for deploying malware or harvesting credentials.<\/p>\n

Below are the file types that may be blind spots in your organization\u2019s detection strategy \u2014 despite being observed as used in real-world attacks.<\/p>\n

Disk images<\/h2>\n

This is the broadest and most dangerous attachment category. A disk image can contain a fully prepared, correctly structured set of files tailored to a wide range of attack scenarios. It mounts as a separate volume (standalone virtual disk), and when doing so often uses tools built into the operating system. The victim doesn\u2019t need to extract anything or create suspicious folders on disk.<\/p>\n

The most versatile format is ISO, which dates back to the heyday of multimedia CDs. ISO images mount natively on every major OS without additional utilities, whether through simple tools like File Explorer or via the command line interface. This is precisely why threat actors have no hesitation in sending ISO files as email attachments<\/a>.<\/p>\n

Somewhat less common are IMG containers, which also mount without additional tooling on macOS or Linux, but require installing a small, free utility such as OSFMount on Windows, or using WSL2 (Windows Subsystem for Linux), which is built into recent Windows versions. A file with identical content may also carry a DD extension.<\/p>\n

Threat actors also make use of VHD<\/a>, a virtual disk format native to Windows, which generally works on Linux machines as well (via qemu-nbd or guestmount). On macOS, an additional utility\u00a0\u2014 again, qemu-nbd is a common choice\u00a0\u2014 is required to mount it. Note that on unpatched Windows systems, the victim doesn\u2019t need to take any further action after the disk mounts: CVE-2025-24993<\/a> \u2014 a vulnerability actively exploited in real-world attacks \u2014 triggers attacker code execution immediately upon mounting the image.<\/p>\n

For completeness\u2019 sake, VMDK, the disk image format used by VMware, is also worth detecting, though it\u2019s largely ineffective in attacks on regular users since every popular OS requires additional software to mount it.<\/p>\n

All of these image formats can be viewed and unpacked not only with specialized tools, but with standard archive utilities like 7-Zip or RAR. As a result, the odds that the user will fall for the bait are higher than one might hope.<\/p>\n

In addition to not being a well-known potentially dangerous format, image files give attackers one further advantage: files extracted from disk images on Windows frequently lack the Mark of the Web flag, and therefore can be launched without triggering additional system warnings.<\/p>\n

There\u2019s one more reason why EPP\/EDR<\/a> solutions must scan virtual machines and disk images: these formats are also used during later stages of an attack. To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim\u2019s computer. The RagnarLocker ransomware strain has used<\/a> VirtualBox for this purpose, while the CRON#TRAP campaign relied on a<\/a> QEMU environment.<\/p>\n

MS Office files<\/h2>\n

No, this isn\u2019t about macro-laced DOC files. Microsoft has grown weary enough of this classic attack vector that macros in downloaded documents are now blocked outright<\/a>, and enabling them requires considerable effort from the user. But Office relies on dozens of file formats, and some of the less common ones still occasionally give attackers an edge.<\/p>\n

Less familiar to both users and security solutions are OneNote files (.one). These are essentially simple notes, but they can carry embedded attachments, including not just images and links, but VBS\/WSF\/BAT scripts as well. Within the note, an attachment normally displays as an icon, but attackers overlay it with a picture<\/a> showing a message with a \u201cView\u201d button.<\/p>\n

Another Office format popular with attackers is the Excel add-in. These files use the .xll extension but are, in effect, full-fledged Windows dynamic-link libraries (DLLs), and therefore may have extensive functionality. Victims receive a malicious email with what looks like an invoice; the icon suggests that the file will open in Excel. Ignoring the security warning may result in an infostealer infection<\/a>.<\/p>\n

SVG \u201cgraphics\u201d<\/h2>\n

The description of the SVG (Scalable Vector Graphics) format sounds entirely innocuous. Indeed, 99% of SVG files are logos and interface icons. But unlike PNG or JPG, SVG files are fundamentally XML documents, and beyond points, lines and fills they can contain JavaScript. In terms of malicious potential, SVG is not far behind a full web page. In real-world attacks<\/a>, SVG files can redirect a user to a phishing page immediately upon opening, or render the phishing page directly by unpacking a Base64-encoded block into full HTML.<\/p>\n

SVG files pose a distinct risk to corporate portals that accept user file uploads. If a portal\u2019s Content Security Policy (CSP) isn\u2019t sufficiently restrictive, and lets someone upload a malicious SVG file, the embedded JavaScript can steal cookies from the page, inject unauthorized content, and carry out similar attacks.<\/p>\n

Polyglot files<\/h2>\n

Polyglot file formats are less exotic in and of themselves, but the files carry more than meets the eye. They\u2019re called polyglots because attackers construct a file that can be validly interpreted in multiple ways: for example, it can be a valid ZIP archive and a valid executable at the same time. The purpose is purely to evade detection by security solutions and deceive the user. We\u2019ve covered polyglots in detail in a separate blog post<\/a>.<\/p>\n

The clear standout in our roundup is a malicious campaign distributing the IcedID infostealer<\/a>. Victims receive emails with a ZIP attachment, which unpacks into an ISO disk image. That further unpacks into a CHM file (the Windows Help format) that\u2019s also correctly processed as an mshta (Microsoft HTML Application host) application, which then downloads the primary malware payload.<\/p>\n

Defending against exotic files<\/h2>\n

These attacks rely on the assumption that security solutions either don\u2019t scan unusual file formats, or scan them only superficially. Preventing the threat starts with not operating on that assumption with regard to your own infrastructure:<\/p>\n