Microsoft has announced a major security change for Outlook for Web and the new Outlook for Windows, removing support for inline SVG (Scalable Vector Graphics) images due to their misuse in cyberattacks.
The Change
- The rollout began in early September 2025 and will finish by mid-October 2025.
- Inline SVGs will now appear as blank spaces, instead of being displayed.
- Traditional SVG attachments remain viewable.
Microsoft said this update will affect fewer than 0.1% of all Outlook images and aims to mitigate cross-site scripting (XSS) and phishing risks.
Why SVGs Are Dangerous
SVG files, while commonly used for web graphics, can contain embedded scripts — making them a powerful tool for phishing and malware delivery.
Recent reports show:
- An 1800% increase in SVG-based phishing attacks between 2024 and 2025.
- Threat actors are leveraging SVGs via PhaaS (Phishing-as-a-Service) kits such as Tycoon2FA, Mamba2FA, and Sneaky2FA.
A Broader Hardening Strategy
This update continues Microsoft’s push to strengthen Outlook and Office security.
Recent changes include:
- Blocking risky file types like .library-ms and .search-ms
- Disabling ActiveX controls and untrusted macros
- Expanding AMSI scanning and default macro blocking across Microsoft 365
These efforts collectively reduce the attack surface exploited by threat actors targeting enterprise mail systems.
Microsoft’s decision underscores a growing industry shift: user-facing features must evolve alongside security threats.
At Alcaeus Services, we help organizations adapt quickly to such changes — ensuring their communication systems stay secure, compliant, and operational as new security policies roll out across Microsoft 365.
