Weaponized SVG: Hidden JavaScript in an Image Attachment

A treasury analyst at a bank opens a SWIFT-themed phishing email carrying an SVG attachment. The image is XML that smuggles Base64-encoded JavaScript; clicking Download PDF writes a ZIP to disk instead. Inside is a JavaScript downloader that wscript.exe runs, pulling a Java loader from an Amazon S3 bucket that deploys the Blue Banana RAT. Walk the email gateway, file artifacts, and endpoint process tree step by step from the spoofed sender to the C2 beacon.