Phishing PDF attachments: fake invoices and real malware

A patched PDF reader does not make an unexpected invoice safe. The file can carry JavaScript, a launch action, or a link to a fake login, and the common case is a Pay Now button with no malware in it at all. Confirm the sender domain and match the invoice to a purchase order before you pay. If you typed a password on a page the PDF opened, change it. A Password Generator can make the replacement. Do not upload a suspicious attachment to a random converter, including a public merge or compress site, to "send it to IT." Report it. Merge PDF and Compress PDF are for files you already trust.

One message had the subject Invoice_8842.pdf — Payment overdue. The logo looked like a freight carrier the company had used twice. The PDF opened: one page, a blue Pay Now button, and a note that missing the 48-hour window would add penalties. Finance nearly clicked. The sender was @freight-billing-support.net. The contracted carrier used a different domain. The file was a phish dressed as a bill, with no exploit code in it.

People learned not to open .exe files. The same attacks moved into PDFs: invoices, tax notices, résumés, shipping labels, and "signed contract" replies. Below is how those messages are built, what a real PDF tends to look like next to them, and how accounts payable and a personal inbox can slow down before paying.

Why a PDF gets opened

Businesses exchange PDF invoices every day. Filters allow them more readily than a ZIP or a macro-enabled Office file.

Logos, fine print, reference numbers, and a legal tone push people to comply.

A link, a button, or an open-url action launches a browser onto a credential harvester. There is no .exe to notice.

Some campaigns attach a harmless-looking PDF and also put a fake login link in the email body, betting that one of the two gets a click.

Reader exploits exist. In small-business targeting they are less common than a link someone clicks. Check the sender and the link first. Patch the reader second.

Patterns

Fake invoice or overdue payment

Urgency, a dollar amount, and bank details you do not recognize. Finance teams see these on Friday afternoons.

Watch for:

• A domain that is close and wrong (amazon-billing-verify.com)
• An invoice number with no matching PO
• A wire to a personal account or a cryptocurrency wallet
• A threat of legal action in 24 to 48 hours

Shipping and delivery failure

"Customs fee required" or "DHL unable to deliver," with a PDF label to print. The link takes card data.

Watch for:

• You did not order anything recently
• A generic greeting ("Dear customer")
• A tracking number in the wrong format for that carrier

HR and payroll

W-2 updates, benefits enrollment, and "salary adjustment" PDFs near tax season.

Watch for:

• Internal HR writing from @gmail.com
• A request for an SSN, or a login, via a link inside the PDF
• Timing outside open enrollment

Résumé and procurement bait

A recruiter or "new vendor" PDF with malware for an HR inbox, or a link to a "portfolio" site.

Watch for:

• Unsolicited bulk mail to a generic inbox
• A name like Resume.exe.pdf or another double extension
• A prompt to enable content or download a "viewer"

A CEO-fraud invoice

Mail from "the CEO" ordering a wire, with a PDF that looks like the invoice behind the story.

Watch for:

• Pressure to skip the normal approval
• A small change in the executive's email address

PDF metadata sometimes shows the tool that built the file, in the author field.

What is inside the file

| Type | Mechanism | Primary defense | | --- | --- | --- | | Embedded link | A button opens a fake login | Do not click. Check the vendor URL you already know | | JavaScript or a launch action | The reader runs a script | A current reader; disable JS in a managed fleet | | Embedded file | The PDF contains another malware file | Block extraction; scan with antivirus | | A form | The PDF posts what you type to the attacker's URL | Do not fill a form you were not expecting | | A QR code | The code opens a fake portal | Treat it like any other unknown link |

Keep Acrobat, the browser's PDF viewer, and the operating system patched. Most consumer phishing skips a fresh exploit and bets on the click.

Before, during, and after

Before you open it

1. Sender. Does the domain match the vendor you know? IT can check Received headers if you are unsure.
2. Context. Were you expecting this document?
3. Filename. Invoice_8842.pdf versus a random hash name.
4. Gateway. Did corporate mail mark it [EXTERNAL] or quarantine it?

While it is open

1. Use an offline or sandboxed preview if policy allows it.
2. Do not enable macros, JavaScript, or "download additional content."
3. Hover a link before you click, or skip the click and type the vendor URL yourself.
4. Do not pay from a button in the PDF. Log into the vendor portal you already use.

If it looks wrong

1. Use the report-phishing button in the mail client.
2. Keep the .eml, or forward the headers to the security team.
3. If you entered credentials, change the password, turn on MFA, and review sessions.
4. Do not forward the PDF to colleagues without a warning on it.

Process beats a suspicious feeling

Accounts payable stops these with process:

• A vendor master file. Bank details change only through a channel you have already verified.
• Two approvals above a wire threshold.
• No payment without a matching PO.
• A callback on a number from the vendor's website, not from the PDF.
• Quarterly training on real examples with the names removed.

A two-person team can still read the domain out loud before paying. That stops most of this fraud.

A real invoice next to a fake one

| Signal | Legitimate pattern | Phish pattern | | --- | --- | --- | | Sender | @knownvendor.com | A lookalike domain | | Timing | Matches the contract cycle | Random urgency | | Payment | The portal you already use | New wire instructions | | Amount | Matches the PO | A round number, plus pressure | | Contact | A rep you know | A generic "Billing Dept" | | Attachment | The type and size you expected | An oddly small one-page file, every time |

Do not upload the sample to a random site

People forward a suspicious PDF to a free merge or compress site so they can send it to IT. That uploads the sample, and sometimes confidential data, to a server you do not know. Report it to security instead.

For ordinary internal PDF work, use an approved client-side tool. See How Browser-Based PDF Tools Protect Your Privacy and Browser File Processing Risks.

A personal inbox

Tax scams, bank alerts, and subscription renewals arrive as PDFs too.

• A government agency rarely demands payment through a link in a PDF.
• A bank wants you in its app, not on a button in a PDF.
• If you are unsure, open the app yourself. Do not start from the attachment.

Turn on MFA for email. A taken-over inbox becomes the next phish to your contacts. See Two-Factor Authentication Basics.

If you already clicked

You opened the PDF, clicked, and entered a password:

1. Change the password immediately, from a clean device.
2. Turn on MFA, or review it.
3. Check forwarding rules and delegate access in email.
4. Tell IT and the financial institution if wire details were exposed.

You opened the PDF and did nothing else:

1. Scan with current antivirus.
2. Report the email.
3. Watch accounts if the PDF contained personal data about you.

Keep the message until the security team says to delete it.

Training

One near-miss beats a yearly slide deck. Walk finance through a Friday phish. Thank the person who paused the wire, in public.

These PDFs depend on speed and on looking official. Slow the payment down. Speed the report up.

Filters miss some of them

Corporate mail filters catch many malicious PDFs and not all of them. Attackers test against major secure email gateways. A fresh domain and a bland one-page invoice get through. External banners exist because the filter missed something.

Do not assume IT blocked every copy. Report a near-miss even when you did not click. The headers help block the next wave.

Home accounts have no gateway. Skepticism and a current reader matter more. Turn on spam filtering. Avoid posting your email in plain text on a forum if you can.

Seasons

The calendar is predictable enough to brief people:

• January through April: tax-refund and W-2 scams
• Back-to-school: fake tuition and student-loan PDFs
• November and December: shipping peaks and fake carrier notices
• Monday mornings: invoice phish aimed at the finance queue

A five-minute reminder before a peak beats the write-up after a breach.

Limits

Antivirus often misses a phishing PDF that contains no malware and relies on a QR code or a login link. Verify a payment or a credential request on a channel that did not come from the PDF.

A PDF is not safe because it is not an .exe. Fake invoices and shipping notices use the habit of trusting documents. The link inside matters more than the extension.

Check the sender, match the invoice to something you already know, pay through a portal you already use, patch the reader, and treat an unexpected PDF as a question. The blue Pay Now button can wait. The approval process should not.