Fake Adobe "document shared with you" emails: how to spot Adobe Acrobat phishing

"Accounts Payable shared a document with you via Adobe Acrobat: Remittance_Advice_Q4.pdf. Click to view." Shared-document emails are part of normal work, which is why attackers copy them. Most fake Adobe shares aren't after an Adobe password at all. They want the password to your email account, Microsoft 365 or Google Workspace. This guide shows what a fake looks like, the one test that catches most of them, how to check a share safely, and what to do after a click.

What is a fake Adobe "document shared with you" email?

A fake Adobe document shared email is a phishing message made to look like an Adobe Acrobat, Adobe Document Cloud or Acrobat Sign notification. It says someone has shared a PDF with you, often an invoice, remittance advice, contract, purchase order or payroll file, and gives you a View document or Open PDF button. The button leads to a page that asks you to "sign in with your email to view the file". Whatever you enter goes to the attacker.

Adobe is used because it's familiar. Nearly every business sends and receives PDFs, so a PDF from Adobe raises no eyebrows. Adobe hasn't been breached for this to happen; the brand is simply copied.

The three versions you'll see

The second version is the hardest to spot. Microsoft has described attackers abusing trusted file-hosting services such as SharePoint, OneDrive and Dropbox, often starting by compromising "a user within a trusted vendor", and leading to a page where "the user is prompted to provide the password and complete multifactor authentication (MFA)" (Microsoft Security Blog). The same trick works with any service that lets anyone host a document. Our guide to file-sharing notification phishing covers the OneDrive, SharePoint and Dropbox versions.

Example of a fake Adobe shared-document email

This is an example written for this guide. It is not a real Adobe email.

From: Adobe Acrobat <share@adobe-doc-cloud.net>
Subject: Mark Jensen shared "Remittance_Advice_Q4.pdf" with you

Mark Jensen (accounts@yoursupplier.com) has shared a
document with you using Adobe Document Cloud.

   Remittance_Advice_Q4.pdf   (2 pages, 184 KB)

   [ View PDF ]

This secure document will expire in 48 hours.
To view it, sign in with the email address this
message was sent to.

Adobe Document Cloud

The page behind View PDF shows a blurred PDF with an email-provider logo and a password box. The tell-tale parts: an unexpected file from a "supplier", an expiry deadline and, above all, a demand for your email password to read a PDF.

How do you know if an Adobe shared document is fake?

Apply one test first: does it ask for your email password to view a PDF? If yes, it's phishing.

Adobe's own description of sharing a PDF for review says recipients need "No sign-ups, sign-ins, or software required. They don't even need Acrobat" (Adobe). Adobe's help page on link access says public links do "not require the recipients to sign-in", while private links work only for invited people and organization links only for people in your organization (Adobe Help). When a restricted share does need a sign-in, it starts on Adobe's own sign-in page. A "PDF viewer" on some other site that asks for your Microsoft 365, Outlook, Gmail or Yahoo password is phishing.

Other red flags:

• You weren't expecting a document from that person, or they've never shared one with you before.
• The file name is generic or financial: "Invoice", "Payment", "Remittance", "Contract", "Proposal", "HR update".
• There's a deadline: "expires in 24 hours" or "access will be revoked".
• The sign-in page shows your email provider's logo, sometimes with your address already filled in.
• The page asks you to pick your provider: Outlook, Office 365, Gmail, Yahoo, "Other mail".
• The sender's address doesn't match the name, or the reply-to goes somewhere else. See reply-to header mismatch phishing.

CISA warns that some phishing emails "will now have perfect grammar and spelling", so don't wait for typos (CISA). For the general checklist, see how to spot a phishing email.

Real Adobe share vs fake Adobe share

How do I check a shared PDF safely?

1. Don't click the button yet. Hover over it on a computer to see the real destination, or long-press on a phone. Our guide to checking if a link is safe explains what to look for.
2. Contact the sender on a number you already have. Ask whether they sent a document and what it's about. Don't reply to the email: if their account is compromised, the attacker answers.
3. If it's real, ask them to attach the file or share it through a system you already use together.
4. If you opened the page, stop at the password box. A PDF viewer that wants your email password is the proof you need. Close the tab.
5. Check the headers if you want proof of the sender. Paste them into the free Email Header Analyzer to see the sending server and SPF, DKIM and DMARC results. A message can pass all three and still be phishing if it came from a real but compromised account or a real cloud service.

Where do I report a fake Adobe email?

Report it in two places: to Adobe and inside your own organization.

• To Adobe: Adobe's Trust Center says that for "an email, website or pop-up window that falsely claims to represent Adobe", you should contact phishing@adobe.com. For "the abuse or misuse of an Adobe product or service for malicious or illegal purposes", such as a real Adobe-hosted page used as a lure, it lists abuse@adobe.com (Adobe Trust Center). Forwarding the email as an attachment keeps its headers.
• At work: use the Report button in Outlook or Report phishing in Gmail, so IT can find and remove other copies. Our guide to reporting a phishing email covers every client.
• For consumers: the FTC asks you to forward phishing emails to reportphishing@apwg.org and report scams at ReportFraud.ftc.gov (FTC).

If the email came from a real supplier's address, tell the supplier by phone too. Their account is probably compromised and is mailing everyone in their contacts.

What should I do if I entered my password on a fake Adobe page?

1. Change the password now, from a trusted device, by typing your provider's address yourself. Change it anywhere you reused it.
2. Tell IT straight away. Say whether you entered an MFA code or approved a prompt. Modern phishing kits pass your code to the real sign-in page in real time; see adversary-in-the-middle phishing.
3. IT revokes sessions and checks the mailbox. Resetting a password doesn't end a session the attacker already has. IT should revoke sessions, remove unknown MFA methods and look for malicious inbox rules and forwarding, which attackers add to hide replies.
4. Warn your contacts if mail went out from your account. The attacker often sends the same "shared document" to everyone you've emailed.

The full sequence is in what to do after clicking a phishing link. Microsoft 365 admins can follow compromised account remediation; Google Workspace admins can follow compromised account recovery.

How can a business stop fake Adobe document emails?

1. Teach the one rule. "A PDF never needs your email password." It covers Adobe, DocuSign, OneDrive and every other share lure. Our guide to fake DocuSign emails covers the e-signature version.
2. Make phone confirmation normal for any unexpected document about money, especially from suppliers. This also blocks vendor invoice fraud.
3. Use phishing-resistant MFA such as passkeys or security keys for admins and finance staff. They don't work on a lookalike sign-in page; see passkeys and phishing-resistant MFA.
4. Block, find and remove. When one user reports a fake share, block the sender and remove every copy. In Microsoft 365, see removing a phishing email from all mailboxes.
5. Check attachments and links before delivery. Attachment-based versions hide the button inside a PDF or HTML file; see PDF phishing attachments and HTML attachment phishing.

Microsoft 365 and Google Workspace filter many of these emails, and for some teams that's enough. An MX-level filter adds a layer before the mailbox: it checks inbound mail for spam, phishing and spoofing, filters risky attachment types and holds suspect messages in a quarantine each user can review. See how iBlockSpam works.

Next steps

1. Tell staff: if a shared PDF asks for your email password, close it and report it.
2. Add phishing@adobe.com to your internal reporting instructions next to your report button.
3. Agree a call-back rule with your main suppliers for any document about payments.
4. Run the free Lookalike Domain Generator on your own domain to see which lookalikes could be used to fake shares from you, and if fake document emails keep reaching your team, see how iBlockSpam works.

Browse our other phishing and threat guides.