Modern Phishing Campaigns Use PDF Files for Attacks
![Modern Phishing Campaigns Use PDF Files for Attacks]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/36-1-998x499.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/36-1-1996x998.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/36-1-1150x575.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/36-1-2298x1105.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/36-1-740x370.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/36-1-1478x739.png"})
Next-generation phishing attacks are actively disguising themselves as brands, abusing Microsoft 365 features, and even leveraging artificial intelligence. In 2025, companies are facing a wave of threats that are changing the rules of cybersecurity.
One of the key techniques is Telephone-Oriented Attack Delivery (TOAD). Victims receive a PDF with instructions to call a number controlled by attackers. During the call, fake Microsoft or PayPal support extracts data or persuades the victim to install malware. Such attacks create a sense of urgency and mimic real call centers, complete with spoofed Caller IDs and VoIP numbers.
PDF files are increasingly used as the primary tool for attacks. They may contain hidden URLs in notes, comments, or embedded QR codes that lead to fake login pages.
Sometimes legitimate links are also included, which increases the victim’s trust and makes detection harder. This is the approach used by the Luna Moth group, which employs VoIP numbers for multi-stage campaigns and remains invisible to security systems. The FBI warns that this technique is becoming a popular method of infiltrating corporate networks.
![Microsoft 365 mail panel with a PDF file and warning icons.]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/36-2-998x666.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/36-2-1976x1318.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/36-2-1050x700.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/36-2-2100x1400.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/36-2-740x494.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/36-2-1478x986.png"})
A new attack vector has also emerged through the use of the legitimate Microsoft 365 Direct Send feature. It allows emails to be sent that appear as internal correspondence without compromising accounts. Since May 2025, at least 70 such attacks have been recorded. The messages usually mimic service notifications and contain PDFs with QR codes designed to harvest credentials.
Such campaigns are becoming multilayered and harder to detect, making continuous monitoring, employee training, and the advancement of protection technologies critically important.
![Datami at the Barcelona Cybersecurity Congress 2025: New Horizons in Cybersecurity]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-554x277.jpg","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-1106x553.jpg","tablet":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-380x190.jpg","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-758x379.jpg","mobile":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-560x280.jpg","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-1118x559.jpg"})
![TOP 5 Largest Cryptocurrency Hacks in History]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/1-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/1-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/1-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-1118x559.png"})
![Top 10 Cyberattacks That Brought Global Corporations to a Halt]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-1118x559.png"})
![Cloudflare Repelled a Record DDoS Attack of 11.5 Tbit/s]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/44-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/44-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/44-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-1118x559.png"})
![Dangerous Calendar: A New Tool for Phishing Attacks]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-554x277.jpg","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-1106x553.jpg","tablet":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-380x190.jpg","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-758x379.jpg","mobile":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-560x280.jpg","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-1118x559.jpg"})
![Phishing is Evolving: What Are the Main Threats in 2025 and How to Counter Them]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-1118x559.png"})