Open Any PDF Safely— Even Malicious Ones

JSFuck-obfuscated payloads inside incremental PDF updates, invisible to half the parser ecosystem. Credential theft and data exfiltration confirmed. Differential parsing discrepancy — MuPDF and Ghostscript saw nothing; Poppler and pdf.js resolved full execution chain.

PDF-based spear-phishing delivering credential harvesters to diplomatic and defence networks. Lure documents used embedded launch actions and URI handlers to silently exfiltrate NTLM hashes. U.S. DOJ & EU CERT attributed; downstream costs likely tens of millions.

Multi-stage payloads hidden in layered PDF streams. Execution deferred by renderer-version fingerprinting — files appeared clean in sandboxes running older Acrobat builds. Policy documents and internal communications exfiltrated across Atlantic-Council-tier organisations.

Invoice-themed PDF lures with embedded DOCX objects and VBA macro loaders staging Carbanak/GRIFFON. Targeted restaurant chains, hotel groups, and point-of-sale operators. Card skimmer deployment followed within hours of initial PDF open event.

PDF files simultaneously valid as ZIP archives (polyglot technique). Opened in Acrobat: rendered a benign invoice. Extracted and executed: deployed SDBot/FlawedGrace loader staging Clop ransomware. Bypassed attachment scanners relying on MIME type or single-parser analysis.

High-volume PDF campaigns carrying macro-enabled Office loaders, credential-stealing scripts, and ransomware staging payloads. PDFs used external /URI and /Launch objects to pull second-stage payloads. Europol-coordinated takedown in 2021; TrickBot and QakBot continued variants.

Exploits fingerprinted the victim’s exact Acrobat version before deciding whether to fire — returning a clean PDF to sandboxes. Targeted executives checking in at high-end hotels via rogue network PDFs. Delivered keyloggers and remote access trojans to C-suite devices undetected for years.

PDF payloads inserted into legitimate software update channels and vendor documentation. Multi-stage encoded payloads hidden in object streams, decoded at runtime via embedded XFA FormCalc. Targeted pharma, tech, and defence supply chains simultaneously for espionage and financial gain.

Mass-distribution invoice PDFs containing QR codes, obfuscated redirect URIs, and credential-harvesting links disguised as DocuSign or Microsoft portals. High success rate in finance teams due to legitimate-looking layouts. Zero malware — pure social engineering amplified by PDF trust signals.

PDF attachments used as the first link in a multi-stage chain: PDF → macro-enabled Office loader → Cobalt Strike beacon → ransomware deployment. Ryuk, Conti, LockBit, and BlackCat all documented this pattern. A single opened PDF in a finance inbox produced full network compromise within 48 hours in multiple documented incidents.

Emotet distributed Word and Excel macro-enabled documents via invoice and shipping-notice lures; embedded VBA executed silently on document open, installing a persistent loader that polled C2 for secondary payloads. It became the world’s #1 initial access broker, staging TrickBot and Ryuk ransomware infections across governments, hospitals, and enterprises in 180+ countries before Europol’s coordinated January 2021 dismantlement.

TrickBot arrived via DOCM and Excel 4.0 XLM macro attachments; macro code silently downloaded the Ostap dropper which fetched modular TrickBot components for browser MITM credential theft, Active Directory reconnaissance, and network propagation. It served as the primary staging platform for Ryuk ransomware and Conti — a single TrickBot infection routinely progressed to full enterprise ransomware within 48–72 hours.

Dridex weaponised Word macro documents with carefully crafted “Enable Content” social engineering prompts, tricking users into activating embedded VBA that silently downloaded the Dridex banking trojan. The malware intercepted online banking sessions via form-grabbing and injected fake login overlays, enabling mass wire fraud. Evil Corp later repurposed the same delivery infrastructure for ransomware campaigns (BitPaymer, WastedLocker, Hades) while operating under OFAC sanctions.

ZLoader’s document chain began with a macro-enabled Word file that downloaded a password-protected Excel workbook; a second VBA layer then abused Rundll32 and other signed Windows binaries (LOLBAS technique) to load the ZLoader DLL while bypassing AV. Malicious MSI installers bearing fraudulent Microsemi Corporation code-signing certificates provided a final evasion layer before staging Egregor and Ryuk ransomware payloads across enterprise networks.

QakBot hijacked legitimate email threads, replying into real business conversations with contextually credible Word or Excel attachments that bypassed recipient suspicion. Embedded XLM macros or VBA downloaded the QakBot executable which persisted via Windows Registry, then staged Cobalt Strike beacons for Black Basta and Conti ransomware operators. The FBI’s Operation Duck Hunt (Aug 2023) dismantled its C2 infrastructure, but variants re-emerged within months under new delivery methods.

Ryuk reached victim networks through a three-stage Office document chain: Word macro attachment (Emotet loader) → credential-theft module (TrickBot lateral movement) → manual Ryuk deployment via reverse shell. The ransomware encrypted network shares with RSA-2048 and AES-256, demanded Bitcoin ransoms averaging $12.5M per incident at its 2019 peak, and deliberately targeted hospitals, municipal governments, and media organisations to maximise extortion pressure and limit victim options.

Conti gained initial access via phishing emails with Office macro attachments that dropped TrickBot, IcedID, or BazarLoader for reconnaissance and lateral movement; Cobalt Strike beacons then enabled hands-on-keyboard operations before Conti encryptor deployment. Leaked internal communications revealed a professional 65-person RaaS operation with HR, management, and a dedicated OPSEC team — industrialised ransomware running at the scale of a mid-sized enterprise.

LockBit affiliates used Office macro documents, exposed RDP endpoints, and compromised VPN credentials as initial access vectors, with an 80/20 affiliate revenue split that drove rapid RaaS adoption. The encryptor deployed AES-256 with double-extortion tactics — file encryption plus data exfiltration to publicly accessible leak sites — targeting hospitals, courts, and critical infrastructure across 120+ countries. Despite Operation Cronos’ infrastructure seizure in February 2024, LockBit resumed public operations within four days.

FIN7 sent personalised Excel spreadsheets to payroll, finance, and executive personnel, exploiting DDE (Dynamic Data Exchange) formulas to launch PowerShell commands without triggering standard macro warnings — a technique that bypassed most enterprise AV of the era. The Carbanak backdoor established C2, enabling lateral movement to POS systems and ATM networks for mass payment card harvesting across restaurant chains, hotel groups, and retail enterprises. FIN7 subsequently pivoted to ransomware operations using the same spear-phishing infrastructure.

Cobalt Strike beacons are delivered via Office macro documents (DOCX, XLSM) containing VBA that spawns cmd.exe and fetches the beacon through encoded PowerShell — typically over HTTP/S to blend with normal web traffic. Once active, the beacon provides command-and-control, lateral movement, credential dumping via Mimikatz, and exfiltration; Iranian Lemon Sandstorm, Chinese APTs, and the Ryuk, Conti, and LockBit ransomware families all leverage it as their standard post-exploitation platform.

FormBook is distributed as a commodity Malware-as-a-Service via phishing emails with malicious DOCX and OLE-embedded attachments; macros or embedded objects download and execute the FormBook stealer payload, which hollows legitimate Windows processes to evade detection. The infostealer harvests browser-saved credentials, screenshots, and keystroke logs from all major browsers, uploading credential dumps to attacker C2 servers where affiliates sell the data on underground markets within hours of capture.

Agent Tesla is delivered via phishing emails with Excel attachments exploiting Office memory corruption vulnerabilities (CVE-2017-11882, CVE-2018-0802) to drop the .NET RAT executable without any macro interaction required. The payload performs keystroke logging, clipboard monitoring, periodic screenshot capture, and credential harvesting across 55+ applications, exfiltrating data via SMTP, FTP, or Telegram C2 channels. Sold for $15–$69/month on criminal forums, it remains one of the most widely deployed credential-theft tools globally.

Ursnif/Gozi spreads via Word documents with VBA macros that install the banking trojan through process injection, establishing persistence via Windows Registry and scheduled tasks. The trojan hooks browser processes via man-in-the-browser (MITB) techniques to intercept online banking sessions in real time, capturing two-factor authentication codes and enabling fraudulent wire transfers. Gozi’s 2014 source code leak spawned over a dozen criminal variants — ISFB, RM3, and GozNym among them — deployed globally for more than a decade.

Hancitor masqueraded as DocuSign notifications or corporate document alerts, delivering Word macro attachments or embedded links that triggered on enable-content; the macro downloaded Hancitor which fetched Pony credential stealer and FickerStealer for immediate data exfiltration. Post-2020 campaigns evolved to deploy Cobalt Strike beacons, bridging commodity credential theft with hands-on-keyboard ransomware operations — an early model of the commodity-to-enterprise escalation pattern that became dominant across the criminal ecosystem.

TamperedChef redirects victims via malvertising to fraudulent AppSuite PDF Editor sites; the trojanised installer executes silently then remains completely dormant for ~56 days before a remote activation command triggers the infostealer. Upon activation the payload terminates all open browsers to extract saved credentials and session cookies, enumerates installed security products, and exfiltrates data to attacker infrastructure — a deliberate dormancy window designed to outlast enterprise sandbox detonation windows and initial-infection investigation periods.