Tactic or Technique: PDF

Attackers use PDF files to deliver malicious content in a format that most people see as safe. These files often appear to be invoices, contracts, or notifications and can include embedded JavaScript, links, or QR codes that lead to phishing sites or malware downloads.
One common example is a fake DocuSign PDF that asks you to scan a QR code or click a link to view a document. The moment you interact, you're taken to a phishing site designed to steal your credentials or deliver malware.
Because PDFs are trusted and can difficult to inspect, they give attackers a way to hide dangerous content behind a familiar format. That trust, combined with limited scanning by some security tools, gives malicious PDFs a clear path into inboxes and environments.
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (6):
Credential Phishing
Malware/Ransomware
BEC/Fraud
Extortion
Callback Phishing
Spam
Detection Methods (16):
File analysis
QR code analysis
URL analysis
Content analysis
Exif analysis
Threat intelligence
Header analysis
Sender analysis
URL screenshot
Whois
Natural Language Understanding
Optical Character Recognition
YARA
Archive analysis
Computer Vision
HTML analysis
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: PDF with recipient email in link
2d ago
Mar 3rd, 2026
Sublime Security
Credential Phishing
PDF
QR code
Encryption
Social engineering
File analysis
QR code analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-recipient-email-in-link-0399d08f
Attachment: PDF with a suspicious string and single URL
3d ago
Mar 2nd, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
/feeds/core/detection-rules/attachment-pdf-with-a-suspicious-string-and-single-url-3bdbb7ad
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
3d ago
Mar 2nd, 2026
Sublime Security
Malware/Ransomware
PDF
Evasion
File analysis
Threat intelligence
/feeds/core/detection-rules/attachment-pdf-object-hash-encrypted-pdfs-with-fake-payment-notification-a8a19bae
Attachment: Finance themed PDF with observed phishing template
3d ago
Mar 2nd, 2026
Sublime Security
Credential Phishing
PDF
Evasion
File analysis
Content analysis
/feeds/core/detection-rules/attachment-finance-themed-pdf-with-observed-phishing-template-c936f7cc
Link: SharePoint OneNote or PDF link with self sender behavior
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
OneNote
PDF
Header analysis
URL analysis
Sender analysis
/feeds/core/detection-rules/link-sharepoint-onenote-or-pdf-link-with-self-sender-behavior-588e7203
Attachment: PDF with suspicious link and action-oriented language
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
File analysis
URL analysis
Content analysis
URL screenshot
/feeds/core/detection-rules/attachment-pdf-with-suspicious-link-and-action-oriented-language-816d33a0
Attachment: PDF with multistage landing - ClickUp abuse
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
PDF
Social engineering
File analysis
URL analysis
Whois
/feeds/core/detection-rules/attachment-pdf-with-multistage-landing-clickup-abuse-0dc40316
Attachment: PDF with ReportLab library and default metadata
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
PDF
Evasion
File analysis
Exif analysis
/feeds/core/detection-rules/attachment-pdf-with-reportlab-library-and-default-metadata-7094bfdd
Attachment: Encrypted PDF with credential theft body
7d ago
Feb 26th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/attachment-encrypted-pdf-with-credential-theft-body-c9596c9a
Attachment: PDF with password in filename matching body text
14d ago
Feb 19th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
Content analysis
File analysis
/feeds/core/detection-rules/attachment-pdf-with-password-in-filename-matching-body-text-2c9c3b24
Credential phishing: Tax form impersonation with payment request
20d ago
Feb 13th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
PDF
Content analysis
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/credential-phishing-tax-form-impersonation-with-payment-request-717695cf
Attachment: Self-sender PDF with minimal content and view prompt
21d ago
Feb 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
Social engineering
Evasion
Content analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-self-sender-pdf-with-minimal-content-and-view-prompt-07670a8c
Link: PDF filename impersonation with credential theft language
21d ago
Feb 12th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
PDF
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/link-pdf-filename-impersonation-with-credential-theft-language-05931513
Attachment: Legal themed message or PDF with suspicious indicators
28d ago
Feb 5th, 2026
Sublime Security
Credential Phishing
Extortion
BEC/Fraud
Evasion
PDF
Social engineering
Content analysis
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Whois
Header analysis
Exif analysis
/feeds/core/detection-rules/attachment-legal-themed-message-or-pdf-with-suspicious-indicators-19133301
Attachment: PDF contains W9 or invoice YARA signatures
29d ago
Feb 4th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
PDF
Social engineering
File analysis
YARA
/feeds/core/detection-rules/attachment-pdf-contains-w9-or-invoice-yara-signatures-9a8e8a98
Attachment: Password-protected PDF with fake document indicators
1mo ago
Jan 21st, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Attachment: Invoice and W-9 PDFs with suspicious creators
1mo ago
Jan 21st, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
/feeds/core/detection-rules/attachment-invoice-and-w-9-pdfs-with-suspicious-creators-305d6e32
Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited)
1mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
Sender analysis
/feeds/core/detection-rules/attachment-pdf-file-with-low-reputation-links-to-suspicious-filetypes-unsolicited-6144f880
Attachment: PDF file with low reputation link to ZIP file (unsolicited)
1mo ago
Jan 12th, 2026
Michael Tingle
Malware/Ransomware
Evasion
PDF
Archive analysis
File analysis
Natural Language Understanding
Sender analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-file-with-low-reputation-link-to-zip-file-unsolicited-d1ee2859
Attachment: QR code link with base64-encoded recipient address
1mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
QR code
Image as content
Social engineering
Evasion
PDF
Macros
Computer Vision
File analysis
Natural Language Understanding
QR code analysis
Sender analysis
/feeds/core/detection-rules/attachment-qr-code-link-with-base64-encoded-recipient-address-927a0c1a
Page 1 of 4