Tactic or Technique: PDF

Attackers use PDF files to deliver malicious content in a format that most people see as safe. These files often appear to be invoices, contracts, or notifications and can include embedded JavaScript, links, or QR codes that lead to phishing sites or malware downloads.
One common example is a fake DocuSign PDF that asks you to scan a QR code or click a link to view a document. The moment you interact, you're taken to a phishing site designed to steal your credentials or deliver malware.
Because PDFs are trusted and can difficult to inspect, they give attackers a way to hide dangerous content behind a familiar format. That trust, combined with limited scanning by some security tools, gives malicious PDFs a clear path into inboxes and environments.
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (6):
Credential Phishing
Malware/Ransomware
BEC/Fraud
Callback Phishing
Extortion
Spam
Detection Methods (15):
File analysis
QR code analysis
URL analysis
YARA
Exif analysis
Optical Character Recognition
Content analysis
Sender analysis
Header analysis
HTML analysis
Natural Language Understanding
Whois
Threat intelligence
Computer Vision
Archive analysis
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: PDF with recipient email in link
2d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
PDF
QR code
Encryption
Social engineering
File analysis
QR code analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-recipient-email-in-link-0399d08f
Attachment: Password-protected PDF with fake document indicators
2d ago
Jan 21st, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Attachment: Invoice and W-9 PDFs with suspicious creators
2d ago
Jan 21st, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
/feeds/core/detection-rules/attachment-invoice-and-w-9-pdfs-with-suspicious-creators-305d6e32
Sharepoint link likely unrelated to sender
11d ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Employee
Lookalike domain
OneNote
PDF
Social engineering
URL analysis
Sender analysis
Header analysis
HTML analysis
/feeds/core/detection-rules/sharepoint-link-likely-unrelated-to-sender-6870f489
Stripe invoice abuse
11d ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
PDF
File analysis
Header analysis
/feeds/core/detection-rules/stripe-invoice-abuse-90162d16
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited)
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Free subdomain host
PDF
Social engineering
File analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-credential-theft-language-and-link-to-a-free-subdomain-unsolicited-90f4ef4e
Attachment: Legal themed message or PDF with suspicious indicators
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Extortion
BEC/Fraud
Evasion
PDF
Social engineering
Content analysis
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Whois
Header analysis
Exif analysis
/feeds/core/detection-rules/attachment-legal-themed-message-or-pdf-with-suspicious-indicators-19133301
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
/feeds/core/detection-rules/urlhaus-malicious-domain-in-message-body-or-pdf-attachment-trusted-reporters-cfca2986
Attachment: QR code with userinfo portion
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
Image as content
PDF
QR code
QR code analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-qr-code-with-userinfo-portion-9d62cc5c
Brand impersonation: Adobe (QR code)
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
QR code
Computer Vision
Header analysis
QR code analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-adobe-qr-code-2fc36c6d
Attachment: Archive with pdf, txt and wsf files
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
/feeds/core/detection-rules/attachment-archive-with-pdf-txt-and-wsf-files-16b2e239
Brand impersonation: Microsoft (QR code)
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
QR code
Social engineering
Computer Vision
Header analysis
QR code analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-microsoft-qr-code-ed0f772a
Attachment: PDF with suspicious language and redirect to suspicious file type
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Evasion
PDF
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-suspicious-language-and-redirect-to-suspicious-file-type-adda3c3f
Attachment: DocuSign impersonation via PDF linking to new domain
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
Social engineering
Header analysis
Sender analysis
URL analysis
File analysis
Computer Vision
Whois
/feeds/core/detection-rules/attachment-docusign-impersonation-via-pdf-linking-to-new-domain-f0c96282
Attachment: PDF file with link to fake Bitcoin exchange
11d ago
Jan 12th, 2026
Sublime Security
BEC/Fraud
Free email provider
Impersonation: Brand
PDF
Social engineering
Exif analysis
File analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-file-with-link-to-fake-bitcoin-exchange-47601cb7
Attachment: PDF with link to DMG file download
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
Content analysis
File analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-link-to-dmg-file-download-2c486fe0
PDF attachment with Google (AE) redirecting to a php or zip file
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Open redirect
PDF
Content analysis
File analysis
URL analysis
/feeds/core/detection-rules/pdf-attachment-with-google-ae-redirecting-to-a-php-or-zip-file-57ae513f
Attachment: PDF with link to zip containing a wsf file
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
Content analysis
File analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-link-to-zip-containing-a-wsf-file-93bc7db4
Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited)
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-pdf-file-with-low-reputation-links-to-suspicious-filetypes-unsolicited-6144f880
Attachment: PDF file with low reputation link to ZIP file (unsolicited)
11d ago
Jan 12th, 2026
Michael Tingle
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
Natural Language Understanding
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-file-with-low-reputation-link-to-zip-file-unsolicited-d1ee2859
Page 1 of 3