PDF phishing attachments: how they work and how to stop them

PDFs are the most trusted file type in business email: invoices, contracts, statements and scans all arrive that way. Attackers know it. A phishing PDF usually contains no malware at all, just a convincing page and a link or QR code to a fake sign-in site. This guide explains how these attacks work, why they slip past filters, what staff should do, and which controls reduce the risk. It complements our broader list of dangerous email attachment types.

How common is PDF phishing?

Common, and growing at the time of writing. Microsoft's Q1 2026 email threat report gives several data points:

• "Malicious PDFs followed a steady upward trajectory, increasing 38% in February and another 50% in March to reach their highest monthly volume in over a year." By March, "PDFs accounted for 29% of payloads, up from 19% in January."
• For QR code phishing, "PDF attachments were the dominant delivery method throughout the quarter, growing from 65% of QR code attacks in January to 70% in March."
• The number of PDF attachments leading to CAPTCHA-gated phishing sites "more than quadrupled in March (+356%)."

The lures Microsoft describes are familiar: routine business notifications and "e‑signature or document delivery requests," built on "urgency, approval language, and transactional framing," with "little to no message body content."

How do phishing PDFs work?

There are four main patterns. Most campaigns use the first two.

The fake "secure document" PDF

The most common design is a page that looks like a protected file: a blurred invoice, a padlock, a logo from Microsoft, Adobe or an e-signature service, and a line such as "This document is protected. Sign in to view." The button links to a fake sign-in page. Nothing in the PDF is malicious code; it's a picture and a link.

Many of these chains add a CAPTCHA page between the PDF and the fake sign-in form. Microsoft says attackers "use CAPTCHA pages to delay detection and increase user interaction" and to "reduce the likelihood of automated scanning tools identifying the threat." See our guide to fake Microsoft login pages for what comes next, and to fake e-signature phishing for the signing-request version.

QR codes inside PDFs

Putting a QR code in a PDF stacks two evasions. The link is in an image, and the image is inside an attachment. The UK's NCSC warns that "not all security tools designed to detect phishing emails will scan images" (NCSC), and the scan happens on a phone that may sit outside company security tools. Our QR code phishing guide covers this in depth.

Callback PDFs

Some PDFs contain no link at all: just an invoice for an antivirus renewal or a subscription you never ordered, and a phone number to "cancel." There's nothing for a link scanner to find. The scam happens on the phone. See callback phishing.

PDFs with active content

The PDF format can do more than display pages. Adobe's Acrobat JavaScript API documents methods such as app.launchURL, which "Launches a URL in a browser window," and PDFs can also carry form actions and attached files. Readers limit this. For that same method, Adobe notes that beginning with Acrobat 8.1, file and javascript URLs "can be executed only when operating in a privileged context." Many browser PDF viewers support less scripting than Acrobat does.

In practice, active content matters most when people use old or unusual PDF readers, or click through warnings. Keep readers updated, and don't open files attached inside a PDF.

Why do phishing PDFs get past spam filters?

A link-lure PDF is hard to call malicious on sight.

• The file is clean. Antivirus looks for malicious code. A PDF with a picture and a hyperlink has none.
• The link is one step removed. Many filters extract and check URLs in the message body. A link inside an attachment needs the filter to open the file first. Microsoft's Safe Links, for example, rewrites links in the message, and its protection for Office apps covers Word, Excel, PowerPoint and some other Microsoft apps (Microsoft Learn). PDF readers aren't on that list.
• The destination is gated. A CAPTCHA, a redirect chain or a page that only shows the phishing form to some visitors means a scanner can see a harmless page.
• The email is bare. Microsoft notes many lures have "little to no message body content," leaving content filters little to judge.
• The sender may be real. If a supplier's mailbox is compromised, the PDF arrives from a genuine address with valid SPF, DKIM and DMARC. See email thread hijacking.
• Blocking isn't an option. You can quarantine HTML files, but not PDFs. Too much real business depends on them.

How should staff handle a PDF attachment?

Give staff a short rule set. These fit on one slide.

1. A PDF should never ask you to sign in. If opening a document leads to a Microsoft, Google or "secure portal" sign-in, close it. Real shared files open from the service you already use, not from a button in an attachment.
2. Don't scan QR codes in documents you didn't expect. Treat them as links.
3. Check the story, not the logo. Were you expecting an invoice, contract or voicemail from this sender? Is the amount, project or name right?
4. Verify through a known channel. Call or message the sender using contact details you already have, not the number in the PDF.
5. Don't call numbers in unexpected invoices for software or subscriptions you don't recognize.
6. Ignore "enable" prompts. If a PDF asks to open another file, run something or allow a site, choose no.
7. Report it. Use your mail app's report button. If you typed a password, follow what to do after clicking a phishing link and tell IT immediately.

Which admin controls reduce PDF phishing?

No single setting stops it. Layer these.

Sandbox attachments before delivery

Sandboxing opens the attachment in an isolated environment and follows what it does.

• Microsoft 365: Safe Attachments in Defender for Office 365 "uses a virtual environment to check attachments in email messages for harmful attachments (for example, malware, ransomware, and phishing) before they're delivered" (Microsoft Learn). Our guide to Safe Links and Safe Attachments covers licensing and the settings that matter.
• Google Workspace: Security Sandbox supports "Microsoft executables (.exe), Microsoft Office, and PDF," including files inside zip or rar archives. Google lists it for Frontline Plus, Business Standard and Plus, and Enterprise Standard and Plus (Google Workspace Admin Help).

Check links inside attachments

Ask your email platform or filtering service a direct question: does it extract and check URLs and QR codes inside PDF attachments, and does it follow redirects? If the answer is vague, assume some PDF lures will arrive and lean on the other layers.

Quarantine what can't be scanned

Encrypted PDFs and password-protected archives can't be inspected. Quarantine them by default and release only those the recipient expected from a known sender. In Microsoft 365, a Safe Attachments policy set to Block can also turn on Block messages containing encrypted attachments that could not be scanned. At the time of writing (October 2026), Microsoft lets you exclude Acrobat (pdf) from that setting, so check whether yours does before assuming encrypted PDFs are held.

Protect the sign-in, not just the inbox

Most PDF phishing ends at a fake sign-in page. Phishing-resistant MFA limits the damage. The CISA, NSA, FBI and MS-ISAC phishing guidance recommends prioritizing phishing-resistant MFA for administrator and privileged accounts. Codes and push approvals can be relayed by adversary-in-the-middle kits.

Keep readers and browsers updated

Active-content attacks depend on old or unusual readers. Standardize on a current, managed PDF reader or the browser's built-in viewer, and keep it patched.

Make reporting and clean-up fast

When one person reports a PDF lure, search for the same subject, sender or attachment name across all mailboxes and remove it. Microsoft's report recommends zero-hour auto purge and manual purges of messages "similar, but not identical, to those of known bad messages."

A PDF phishing checklist for admins

Next steps

• Send staff the seven rules above, with a screenshot of a fake "secure document" PDF.
• Check whether attachment sandboxing is licensed and switched on for everyone, not just a pilot group.
• When a suspicious PDF arrives, inspect the headers with the free Email Header Analyzer to see where it really came from.
• If you want filtering for phishing, spoofing and attachments in front of every mailbox on your domain, see how iBlockSpam works. It includes attachment-type filters and personal quarantines for every user.

Browse our other phishing and threat guides.