Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Explainer

Understanding Security Risks in PDF Files

Dimitris Gkoutzamanis

7 min read

malicious pdf

PDFs have become a universal format for sharing documents. However, threat actors have also recognized their potential as a vector for cyberattacks. In this article, we will discuss the common tactics used by malicious actors to weaponize PDF files and the best practices for defending against such threats.

PDFs as a Convenient Attack Vector

PDFs are appealing to threat actors due to their widespread use in business communications, making them an inconspicuous delivery method for malware and exploits. Let’s explore the tactics they employ:

1. Embedded JavaScript and Actions

One common tactic is abusing active content. PDFs can carry embedded JavaScript and actions that run when the document is opened, and attached files that the reader may be tricked into opening, which can lead to malware being downloaded onto the victim’s system.

2. Exploiting Vulnerabilities

Threat actors often search for vulnerabilities in PDF readers. They craft PDFs to exploit these vulnerabilities, gaining unauthorized access to the victim’s device or network.

3. Social Engineering

PDFs can be laced with social engineering techniques. Attackers create enticing content or disguise malicious files as legitimate ones, tricking users into opening them.

PDFs are considered a trustworthy file format for sharing documents. When recipients receive a PDF file, they often assume it’s a legitimate document, making them more likely to open it without suspicion.

Attackers leverage the familiarity of PDFs to conduct social engineering attacks. For example, they might send a phishing email with an attachment that appears to be an invoice or a job application (resume) in PDF format. Recipients, trusting the format, are more likely to open the attachment, unknowingly exposing themselves to threats.

Protecting Against PDF-Based Attacks

To safeguard your organization and personal devices from PDF-based threats, consider the following best practices:

1. Keep Software Updated

Regularly update your PDF reader and other software to patch known vulnerabilities and protect against exploitation.

2. Disable JavaScript Unless You Need It

Configure your PDF reader so that embedded JavaScript does not run unless you need it, and keep its built-in protections on.

Here are the steps in Adobe Acrobat Reader:

  1. Open Adobe Acrobat Reader: Launch the Adobe Acrobat Reader application on your computer.
  2. Access Preferences:
  • On Windows: Click on “Edit” in the top menu, then select “Preferences.”
  • On macOS: Click on “Acrobat Reader” in the top-left corner, then select “Preferences.”
  1. Turn Off JavaScript: In the Preferences window, you’ll see a list of categories on the left. Click on “JavaScript” and clear “Enable Acrobat JavaScript.” Organizations can enforce this by policy (the bEnableJS value under JSPrefs).
  2. Keep Enhanced Security On: Click on “Security (Enhanced)” and make sure “Enable Enhanced Security” is checked. It has been on by default since the 9.3 and 8.2 updates and blocks risky actions such as cross-domain access, data injection and silent printing, but it does not turn off JavaScript.
  3. Use Protected View (Windows): In the same section, under “Sandbox Protections,” set Protected View to files from potentially unsafe locations, or to all files. It is off by default.
  4. Be Careful with Privileged Locations (Optional): Files and folders in the “Privileged Locations” section bypass these restrictions. Exercise caution when adding locations to this list and only do so if you are confident in the source.
  5. Apply Changes: After making your selections, click the “OK” or “Apply” button to save your preferences.
  6. Restart Adobe Acrobat Reader: Close and then reopen Adobe Acrobat Reader to ensure that your changes take effect.

3. Exercise Caution with Email Attachments

  1. Verify the Sender’s Identity:
  • Check the sender’s email address carefully. Be cautious if the email address looks suspicious or unfamiliar.
  • Look for any unusual email addresses, misspellings, or variations of legitimate senders’ addresses.
  1. Subject Line and Email Content:
  • Pay attention to the subject line and email content. If they contain spelling errors, odd language, or seem out of context, be suspicious.
  • Be cautious of urgent or unsolicited emails with PDF attachments, especially those requesting sensitive information or actions.
  1. Use a Reputable Email Client:
  • Ensure that you are using a trustworthy and up-to-date email client. Reputable email services often include built-in security features to scan attachments for malware.
  1. Hover Over Links and Buttons:
  • If the email contains links or buttons prompting you to download a PDF attachment, hover your mouse cursor over them without clicking. This action will reveal the actual destination URL. Be cautious if the URL seems unrelated to the email’s content or appears suspicious.
  1. Don’t Open Unexpected Attachments:
  • If you receive an email with an unexpected PDF attachment from an unknown or untrusted source, refrain from opening it. Verify the sender’s identity and legitimacy before proceeding.
  1. Check File Names:
  • Carefully inspect the file name of the PDF attachment. If it includes random characters, unusual symbols, or misspellings, exercise caution.
  1. Ask for Verification:
  • If you receive an unexpected PDF attachment from someone you know, but the content or context seems unusual, contact the sender separately (via phone or another email) to verify if they indeed sent the attachment.

4. Implement Robust Endpoint Security

Utilizing endpoint security is a critical component of safeguarding your devices and networks against malicious PDF documents. Endpoint security solutions play a pivotal role in the detection and protection from these threats through various mechanisms:

  1. Real-Time Scanning: Endpoint security software continually scans files, including PDFs, as they are accessed or downloaded. This real-time scanning identifies any suspicious or known malware signatures within PDF files before they can be executed.
  2. Behavioral Analysis: Modern endpoint security solutions employ behavioral analysis techniques. They monitor the behavior of processes and applications, including PDF readers, to detect unusual or malicious activities. If a PDF attempts to perform actions that are not typical for a benign document, it raises an alert.
  3. Heuristic Analysis: Heuristic analysis involves identifying potential threats based on patterns and characteristics rather than relying solely on known signatures. If a PDF exhibits behaviors or contains elements that match known malicious patterns, the endpoint security system can flag it as a potential threat.
  4. Sandboxing: Some endpoint security solutions use sandboxing technology to isolate and execute PDFs in a controlled environment. If a PDF tries to execute malicious actions, the sandbox detects it and prevents any harm from reaching the actual system.
  5. Signature-Based Detection: Although not foolproof, signature-based detection is still valuable. Endpoint security software maintains a database of known malware signatures, including those specific to malicious PDFs. When a PDF matches a known signature, it is flagged and blocked.
  6. Threat Intelligence Feeds: Endpoint security solutions often integrate threat intelligence feeds that provide real-time information about emerging threats. These feeds help the software stay updated on the latest techniques and attack vectors used by threat actors, including those targeting PDFs.
  7. Content Analysis: Some endpoint security solutions offer advanced content analysis capabilities. They examine the content and structure of PDF files to identify hidden malicious elements, even if they are obfuscated or buried deep within the document.
  8. User Behavior Analytics: Monitoring user behavior can be part of endpoint security. If a user’s actions with a PDF, such as opening multiple suspicious PDFs in a short time, deviate from their typical behavior, the system may raise an alert.
  9. Automatic Updates: Endpoint security solutions are regularly updated with new threat definitions and security patches. These updates ensure that the software remains effective against the latest PDF-based threats.
  10. Integration with Email and Web Security: Endpoint security solutions can integrate with email and web security systems to provide comprehensive protection. This means that malicious PDFs received via email or downloaded from the internet can be detected and blocked at the endpoint.

Correction, 26 October 2026: this article said PDFs carry macros and that Enhanced Security in Adobe Acrobat Reader protects against them; PDFs have no macros, their active-content risks are embedded JavaScript, launch actions and attached files, and JavaScript is turned off separately under Preferences > JavaScript.