The Hacker's Canvas: SVG-Embedded Phishing to M365 Credential Theft

An accounts-payable clerk at a drayage firm opens an SVG email attachment disguised as an inbound fax. The SVG is not an image: its embedded obfuscated JavaScript starts a chained redirect through a Cloudflare Workers subdomain protected by a Turnstile CAPTCHA, to an attacker-registered fake Microsoft 365 sign-in portal that silently POSTs the typed password to a separate collection server. Work the email, endpoint, web-proxy, DNS, and Entra sign-in records to reconstruct the redirect chain, the harvest endpoint, and the mailbox access that followed.