Loading story…
Attackers sharply expanded the use of malicious PDF files in phishing campaigns, with observed samples rising from 411,800 in 2019 to 5,224,056 in 2020, according to Palo Alto Networks Unit 42. Researchers identified five dominant lure themes: fake CAPTCHA, coupons, play buttons, file sharing, and e-commerce. Fake CAPTCHA PDFs accounted for nearly 40% of observed samples and commonly pushed victims toward browser notification abuse, malvertising, and in some cases malicious Chrome extension installation.
Many of the campaigns relied on traffic redirection to evade takedowns, swap final landing pages, and monetize victims through affiliate-style schemes. File-sharing themed PDFs were also used for credential theft by impersonating services including Dropbox, OneDrive, Atlassian, and Microsoft login pages. The report also published indicators of compromise, redirector domains, final hosts, and YARA rules to help defenders detect several categories of PDF-based phishing activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The report described how many 2020 PDF phishing campaigns used redirector sites to evade takedowns, rotate destinations, and monetize victims through affiliate-style flows. It also published indicators of compromise, redirector domains, final hosts, and YARA rules for several PDF phishing categories.
Using WildFire data collected throughout 2020, researchers classified phishing PDFs into five leading themes: fake CAPTCHA, coupon, play button, file sharing, and e-commerce. The fake CAPTCHA category was the largest, accounting for close to 40% of observed phishing PDFs.
Palo Alto Networks reported that malicious PDF files observed via WildFire increased from 411,800 in 2019 to 5,224,056 in 2020, a 1,160% rise. The report also said PDF malware represented 0.009% of total PDFs in 2019 and 0.08% in 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 73 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026
Multiple phishing campaigns used **Adobe-themed document lures** and trusted cloud platforms to gain remote access on victim systems. Cloudflare and CyberArmor reported broad activity abusing **Vercel-hosted** pages that impersonated PDF viewers, invoices, shipping notices, legal alerts, and account warnings, then delivered executables or selectively served payloads after fingerprinting visitors through **Telegram-based filtering**. Rather than relying solely on custom malware, the operators frequently installed legitimate remote management software such as **GoTo Resolve/LogMeIn**, turning signed admin tools into living-off-the-land backdoors while hiding behind trusted domains including `vercel.app` and similar hosting services. A separate but related spear-phishing operation targeted Pakistan's **Punjab Safe Cities Authority (PSCA)** and **PPIC3** with a fake "Safe Jail Project" email carrying a VBA-stomped Word file and a PDF lure. Joe Sandbox found the Word document fetched `code.exe` from **BunnyCDN** infrastructure, invoked Microsoft's **VS Code tunnel** service for covert persistence, and sent compromise notifications to an attacker-controlled **Discord webhook**, while the PDF pushed victims toward an unsigned **ClickOnce** manifest masquerading as an Adobe update. The reporting shows a consistent pattern of attackers blending malicious delivery with legitimate services, signed remote-access tools, and staged payloads to evade detection and maintain control of compromised hosts.
Jun 29, 2026
Threat actors widely exploited COVID-19 news, relief programs, testing, and vaccine demand to increase the effectiveness of phishing and malware campaigns, while mostly reusing established malware and infrastructure. Microsoft reported an eleven-fold jump in COVID-19-themed attacks after the disease was formally named, but said these campaigns remained a small share of overall activity and largely repurposed existing tradecraft. Palo Alto Networks tracked **69,950** pandemic-related phishing URLs from early 2020 through early 2021, including a **530%** rise in vaccine-themed phishing and a **189%** increase in pharmacy- and hospital-related lures, with many pages harvesting Microsoft 365, Outlook, and webmail credentials or personal and financial data from newly created and compromised sites. The same social-engineering theme was used to deliver a broad mix of malware across desktop and mobile platforms. Researchers linked COVID-19 spam and fake sites to loaders and commodity malware including **GuLoader**, **Parallax RAT**, **Remcos**, **Agent Tesla**, **NanoCore**, **NetWire**, **AzorUlt**, **FormBook**, **TrickBot**, and **MetaMorfo**, often relying on malicious attachments, macro-enabled Office files, or exploits such as `CVE-2017-11882`; Microsoft and others warned users not to enable macros in untrusted documents. More disruptive campaigns included **Netwalker** ransomware delivered through a `CORONAVIRUS_COVID-19.vbs` attachment, Android fraud via the **Ginp** trojan’s fake “Coronavirus Finder,” an Android **SLocker** variant that locked devices with COVID-19-themed ransom messages, and later low-volume phishing that used WHO-themed documents to install **Nerbian RAT** with anti-analysis and persistence features.
Aug 15, 2026