Tactic or Technique: PDF

Attackers use PDF files to deliver malicious content in a format that most people see as safe. These files often appear to be invoices, contracts, or notifications and can include embedded JavaScript, links, or QR codes that lead to phishing sites or malware downloads.
One common example is a fake DocuSign PDF that asks you to scan a QR code or click a link to view a document. The moment you interact, you're taken to a phishing site designed to steal your credentials or deliver malware.
Because PDFs are trusted and can difficult to inspect, they give attackers a way to hide dangerous content behind a familiar format. That trust, combined with limited scanning by some security tools, gives malicious PDFs a clear path into inboxes and environments.
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (6):
Credential Phishing
Malware/Ransomware
Extortion
BEC/Fraud
Callback Phishing
Spam
Detection Methods (15):
Content analysis
File analysis
Sender analysis
Natural Language Understanding
Header analysis
URL analysis
Optical Character Recognition
Whois
Exif analysis
YARA
QR code analysis
Threat intelligence
HTML analysis
Computer Vision
Archive analysis
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: Self-sender PDF with minimal content and view prompt
5h ago
Feb 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
Social engineering
Evasion
Content analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-self-sender-pdf-with-minimal-content-and-view-prompt-07670a8c
Link: PDF filename impersonation with credential theft language
6h ago
Feb 12th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
PDF
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/link-pdf-filename-impersonation-with-credential-theft-language-05931513
Attachment: Legal themed message or PDF with suspicious indicators
7d ago
Feb 5th, 2026
Sublime Security
Credential Phishing
Extortion
BEC/Fraud
Evasion
PDF
Social engineering
Content analysis
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Whois
Header analysis
Exif analysis
/feeds/core/detection-rules/attachment-legal-themed-message-or-pdf-with-suspicious-indicators-19133301
Attachment: PDF contains W9 or invoice YARA signatures
8d ago
Feb 4th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
PDF
Social engineering
File analysis
YARA
/feeds/core/detection-rules/attachment-pdf-contains-w9-or-invoice-yara-signatures-9a8e8a98
Attachment: Password-protected PDF with fake document indicators
22d ago
Jan 21st, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Attachment: PDF with recipient email in link
22d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
PDF
QR code
Encryption
Social engineering
File analysis
QR code analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-recipient-email-in-link-0399d08f
Attachment: Invoice and W-9 PDFs with suspicious creators
22d ago
Jan 21st, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
/feeds/core/detection-rules/attachment-invoice-and-w-9-pdfs-with-suspicious-creators-305d6e32
Stripe invoice abuse
1mo ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
PDF
File analysis
Header analysis
/feeds/core/detection-rules/stripe-invoice-abuse-90162d16
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
/feeds/core/detection-rules/urlhaus-malicious-domain-in-message-body-or-pdf-attachment-trusted-reporters-cfca2986
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited)
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Free subdomain host
PDF
Social engineering
File analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-credential-theft-language-and-link-to-a-free-subdomain-unsolicited-90f4ef4e
Sharepoint link likely unrelated to sender
1mo ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Employee
Lookalike domain
OneNote
PDF
Social engineering
URL analysis
Sender analysis
Header analysis
HTML analysis
/feeds/core/detection-rules/sharepoint-link-likely-unrelated-to-sender-6870f489
Attachment: QR code with userinfo portion
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
Image as content
PDF
QR code
QR code analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-qr-code-with-userinfo-portion-9d62cc5c
Brand impersonation: Adobe (QR code)
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
QR code
Computer Vision
Header analysis
QR code analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-adobe-qr-code-2fc36c6d
Attachment: Archive with pdf, txt and wsf files
1mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
/feeds/core/detection-rules/attachment-archive-with-pdf-txt-and-wsf-files-16b2e239
Brand impersonation: Microsoft (QR code)
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
QR code
Social engineering
Computer Vision
Header analysis
QR code analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-microsoft-qr-code-ed0f772a
Attachment: PDF with suspicious language and redirect to suspicious file type
1mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Evasion
PDF
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-suspicious-language-and-redirect-to-suspicious-file-type-adda3c3f
Attachment: DocuSign impersonation via PDF linking to new domain
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
Social engineering
Header analysis
Sender analysis
URL analysis
File analysis
Computer Vision
Whois
/feeds/core/detection-rules/attachment-docusign-impersonation-via-pdf-linking-to-new-domain-f0c96282
Attachment: PDF file with link to fake Bitcoin exchange
1mo ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Free email provider
Impersonation: Brand
PDF
Social engineering
Exif analysis
File analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-file-with-link-to-fake-bitcoin-exchange-47601cb7
Attachment: PDF with link to DMG file download
1mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
Content analysis
File analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-link-to-dmg-file-download-2c486fe0
PDF attachment with Google (AE) redirecting to a php or zip file
1mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Open redirect
PDF
Content analysis
File analysis
URL analysis
/feeds/core/detection-rules/pdf-attachment-with-google-ae-redirecting-to-a-php-or-zip-file-57ae513f
Page 1 of 3