PDFs: Portable documents, or perfect deliveries for phish?
Summary: Cisco Talos reports that PDF attachments are being used to deliver brand impersonation phishing, including QR code phishing and callback phishing (TOAD), with Microsoft and Docusign among the most impersonated brands in PDF-attached emails between May 5 and June 5, 2025. Talos also observed e-signature service abuse on Adobe between April and May 2025, and the number +1-818-675-1874 reused in TOAD emails impersonating Best Buy's Geek Squad brand for four consecutive days.
What you should know: Because the entire email body can be embedded in a PDF and rendered on open, these attacks evade filters that rely on textual features unless OCR is applied, and OCR is error-prone and raises computational costs. Phone numbers in TOAD emails often stay under the radar for several days because they are rarely shared with third-party reputation services.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026