TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

ESET WeLiveSecurity

Beware of threats lurking in booby-trapped PDF files

2025-10-06 · Read original ↗

ATT&CK techniques detected

8 predictions
T1204.002Malicious File
96%
"executable. - exploiting vulnerabilities in pdf readers : malformed objects or specially crafted content can take advantage of bugs in vulnerable versions of common pdf readers and lead to code execution, as was the case with a software loophole affecting adobe reader and documen…"
T1566.001Spearphishing Attachment
96%
"the file has a misleading visible name or double extension. this is the case with names like invoice. pdf. exe or document. pdf. scr, especially where attackers cast their nets wide and intend to ensnare as many people as possible. these files actually aren ’ t pdfs at all – they…"
T1204.002Malicious File
83%
"malicious campaigns. a wolf in sheep ’ s clothing booby - trapped pdfs typically arrive as email attachments or links in phishing messages that trick victims into taking action. as is common with social engineering campaigns, the lures are carefully crafted to spark emotion, such…"
T1204.002Malicious File
82%
"take these precautions : - resist the temptation to immediately download or open the file. the adage “ when in doubt, kick it out ” works here nicely. - verify the sender and context. before opening the potentially sketchy attachment, contact the sender by a separate communicatio…"
T1566.001Spearphishing Attachment
56%
"malicious campaigns. a wolf in sheep ’ s clothing booby - trapped pdfs typically arrive as email attachments or links in phishing messages that trick victims into taking action. as is common with social engineering campaigns, the lures are carefully crafted to spark emotion, such…"
T1566.001Spearphishing Attachment
54%
"beware of threats lurking in booby - trapped pdf files pdf files have become a staple of our daily digital lives, both at work and at home. they work seamlessly across operating systems and devices, and they couldn ’ t be easier to create and share. every day, countless pdf ( por…"
T1204.002Malicious File
49%
"exfiltration or further payload downloads. - run a full computer scan with an updated security solution. if you don ’ t have any, run a one - time check as available courtesy of eset ’ s free scanner. - check running processes and network connections for anomalies. if you ’ re no…"
T1204.002Malicious File
40%
"up - to - date. - enable protected view or sandbox mode in your pdf reader of choice and consider adjusting or disabling your javascript settings in it. - use reputable, multi - layered security software on all your devices. it ’ s safe to say that cybercriminals will continue to…"

Summary

Looks can be deceiving, so much so that the familiar icon could mask malware designed to steal your data and money.