How to Protect Your Business from Malicious PDF Files

PDF files are used throughout modern business. Invoices, quotations, contracts, reports, application forms and delivery documents are routinely exchanged by email, downloaded from websites and shared through cloud platforms.

That familiarity can make PDFs appear harmless. Unfortunately, cybercriminals can exploit them to deliver malicious links, redirect users to fake login pages or take advantage of vulnerabilities in outdated PDF-reading software.

A malicious PDF does not always look suspicious. It may use a genuine company logo, refer to a real supplier or appear to be part of an existing business process. Protecting your organisation therefore requires more than simply telling employees not to open unexpected attachments.

Businesses need several layers of technical protection, clear procedures and informed users.

How Can a PDF Become Malicious?

A PDF can be used as part of an attack in several ways.

Some malicious PDFs contain links that direct the recipient to a fraudulent Microsoft 365 login page, payment portal or document-sharing website. Others may include active content, embedded files or code designed to exploit a vulnerability in the software used to open them.

In some campaigns, the file itself is primarily a delivery mechanism. The PDF presents a convincing message asking the user to click a button, scan a QR code, download another file or sign into an online account.

The NCSC has documented phishing activity in which malicious links embedded within email attachments directed victims to credential-stealing websites. CISA also warns that attackers commonly use malicious attachments and links to download malware or begin a wider compromise. 

Why Businesses Are Vulnerable

PDF-based attacks are effective because receiving documents is a normal part of many roles.

Accounts teams regularly receive invoices. HR departments open CVs and employment documents. Sales teams receive purchase orders and enquiries, while senior staff may be sent contracts, reports or confidential-looking files.

Attackers exploit this expectation by creating a sense of urgency. A message may claim that:

• An invoice is overdue
• A payment has failed
• A contract needs signing immediately
• A document has been shared securely
• A delivery could not be completed
• Payroll or banking details have changed
• An account will be suspended
• A complaint or legal notice is attached

The goal is to make the recipient act before carefully considering whether the message is genuine.

1. Treat Unexpected PDFs with Caution

Employees should pause before opening any unexpected attachment, even when the file appears to come from a recognised organisation.

They should consider:

• Were they expecting the document?
• Does the sender’s address match the organisation?
• Is the language or request unusual?
• Is the sender creating unnecessary urgency?
• Does the message request a password, payment or account change?
• Could the sender’s genuine mailbox have been compromised?

Where there is doubt, the recipient should verify the document through a separate communication channel. For example, they could call the supplier using a known telephone number rather than replying to the email or using contact details contained within the attachment.

2. Do Not Trust a File Because It Has a PDF Icon

Cybercriminals may disguise other file types so that they appear to be PDFs.

A file could have a misleading name, use a PDF-style icon or contain a double extension such as:

Invoice.pdf.exe

If Windows is configured to hide known file extensions, the user may see only Invoice.pdf.

Businesses should configure managed devices to display full file extensions and train employees not to open unexpected executable, script or compressed files.

A familiar icon is not proof that a file is safe.

3. Keep PDF Software Fully Updated

Outdated applications can contain vulnerabilities that attackers may exploit through specially constructed documents.

Adobe has released security updates addressing vulnerabilities in Acrobat and Reader, including issues that could potentially allow arbitrary code execution. This demonstrates why PDF software must be included in the organisation’s patch-management process rather than left for users to update manually. 

Businesses should:

• Use supported PDF-reading software
• Enable automatic updates
• Remove obsolete PDF applications
• Monitor whether updates are successfully installed
• Restrict users from installing unapproved PDF tools
• Include browsers and operating systems in the same update policy

Where possible, updates should be centrally managed through tools such as Microsoft Intune or another endpoint-management platform.

4. Keep Protected Mode and Enhanced Security Enabled

Modern PDF applications include security features designed to isolate untrusted documents from the rest of the device.

Adobe Acrobat Reader’s Protected Mode opens PDFs in a restricted sandbox, while Protected View can disable many features until the document is trusted. Adobe recommends keeping Protected Mode enabled because it helps protect the device from potentially malicious PDFs. 

Businesses should avoid disabling these features simply because an application or document will not work as expected. Security controls should only be changed after the issue has been investigated and the document or application has been confirmed as trustworthy.

Enhanced security can also restrict a PDF’s access to external content, local files and cross-domain communications. 

5. Use Advanced Email Security

Basic spam filtering is no longer sufficient for every organisation.

A strong email-security platform should inspect attachments, identify suspicious senders, analyse links and quarantine files that appear malicious.

Microsoft Defender for Office 365 Safe Attachments opens supported attachments in a virtual environment to observe what happens when the file is opened. This process, often called detonation, provides an additional layer of protection beyond ordinary antimalware scanning. 

Safe Links can also inspect links in email and perform checks when a user clicks them, helping protect against malicious URLs that may be hidden inside messages or documents. 

Your email-security policies should be configured carefully and applied to all relevant users, not only senior employees.

6. Protect Files Shared Through Teams, SharePoint and OneDrive

PDF files do not arrive only through email.

They may also be uploaded to Microsoft Teams, SharePoint, OneDrive, customer portals and shared project folders. A malicious file placed into a trusted collaboration platform can appear more credible because employees assume that documents stored there have already been checked.

Microsoft Defender for Office 365 can extend Safe Attachments protection to SharePoint, OneDrive and Teams, providing additional analysis of files stored and shared through those services. 

Businesses should apply consistent security controls across all channels through which documents can enter the organisation.

7. Protect Users from Links Inside PDFs

A PDF may contain a button labelled:

• View document
• Download invoice
• Sign in to continue
• Review secure message
• Confirm payment
• Access shared file

These buttons can lead to convincing phishing websites.

Employees should be trained to inspect destinations carefully and avoid signing in through links contained in unexpected documents. When a document claims to relate to Microsoft 365, banking, payroll or another business service, users should navigate to the service through a trusted bookmark or known address instead.

PDF software can also be configured to warn users before opening external websites or to restrict access to untrusted destinations. Adobe provides controls for allowing or blocking website links opened from PDFs. 

8. Use Endpoint Protection and Application Control

Endpoint security provides another defence if a malicious file reaches a device.

Business-grade endpoint detection and response can identify suspicious behaviour such as:

• A PDF application launching another process
• Unexpected script execution
• Attempts to download additional malware
• Credential-stealing behaviour
• Unusual changes to system files
• Suspicious connections to external servers

The NCSC advises organisations to protect devices against malware, while CISA recommends controls capable of detecting malicious behaviour as well as known signatures. 

Application-control policies can further reduce risk by preventing unapproved executables, scripts and utilities from running.

9. Apply Least-Privilege Access

Employees should not routinely work with local administrator privileges.

When users have excessive permissions, malware may be able to make wider changes to the device, disable security tools or install additional software. Standard user accounts can limit the impact of a successful attack.

Access should also be reviewed across Microsoft 365, file servers and business applications. A compromised account should only be able to reach the information genuinely required for that person’s role.

Least privilege will not prevent every malicious PDF from being opened, but it can significantly reduce the damage that follows.

10. Use Multi-Factor Authentication

Many malicious PDFs are designed to steal passwords rather than directly infect a device.

A user may click a link, arrive at a realistic login page and enter their Microsoft 365 credentials. Multi-factor authentication adds another barrier by requiring additional verification before the attacker can access the account.

However, MFA is not a substitute for good security awareness. Some modern phishing methods attempt to capture session information or persuade users to approve fraudulent sign-in requests.

Businesses should therefore combine MFA with conditional access, sign-in monitoring and phishing-resistant authentication methods where appropriate.

11. Make Suspicious Emails Easy to Report

Employees need a simple way to report a suspicious PDF without forwarding it to colleagues or attempting to investigate it themselves.

A reporting button in Outlook can allow the message to be submitted to the internal IT or security team for analysis. The NCSC provides guidance for configuring phishing-reporting functionality in Microsoft 365 Outlook environments. 

Your reporting process should tell employees:

• What to report
• How to report it
• What to do after reporting
• Who to contact when the request appears urgent
• What to do if they have already opened the file or entered details

Employees should be praised for reporting potential threats rather than discouraged by an overly punitive culture.

12. Provide Relevant Security Awareness Training

Generic annual training is unlikely to be enough.

Employees should be shown realistic examples connected to their responsibilities. Accounts staff should understand fraudulent invoice and bank-detail attacks, while HR teams should recognise risks associated with CVs and application documents.

Training should cover:

• Unexpected attachments
• Lookalike sender domains
• Fake cloud-sharing notifications
• QR codes contained in PDFs
• Password-protected attachments
• Requests to enable additional features
• Fraudulent payment instructions
• Credential-harvesting websites
• Internal reporting procedures

Regular phishing simulations can help identify where additional support is required, but they should be used to educate rather than embarrass employees.

13. Be Careful with Password-Protected PDFs

A password-protected PDF is not automatically secure.

Attackers sometimes protect malicious attachments with a password and include that password in the email. This may prevent some automated security tools from inspecting the file before it reaches the recipient.

Unexpected encrypted or password-protected documents should therefore be treated cautiously. Employees should verify the sender and the reason for the protection before opening them.

Email systems should also be configured to quarantine or apply additional checks to encrypted attachments where the business does not regularly require them.

14. Maintain Reliable Backups

Should a malicious attachment lead to ransomware or destructive malware, reliable backups can be essential to recovery.

Backups should be:

• Taken regularly
• Protected from ordinary user accounts
• Separated from the live environment
• Monitored for failures
• Retained according to business requirements
• Tested through restoration exercises

CISA’s ransomware guidance recommends controls including attachment filtering, protected backups and rehearsed incident-response procedures. 

A backup that has never been tested should not be assumed to be recoverable.

What Should You Do If Someone Opens a Suspicious PDF?

Opening a suspicious file does not always mean the device has been compromised, but it should be reported immediately.

The user should:

1. Stop interacting with the document.
2. Avoid clicking further links or entering credentials.
3. Contact the IT or security team.
4. Explain what was opened and what actions were taken.
5. Disconnect the device from the network if instructed.
6. Change affected passwords from a known-safe device if credentials were entered.
7. Avoid deleting the email, as it may be needed for investigation.

The IT team can then isolate the endpoint, review email and security logs, block related links or senders, search for other recipients and determine whether wider remediation is required.

The NCSC recommends having a defined and rehearsed incident-response process rather than waiting until an infection occurs. 

How Hamilton Group Can Help

Protecting your business from malicious PDFs requires controls across email, endpoints, identities, cloud platforms and employee procedures.

Hamilton Group can help your organisation assess and strengthen these areas through:

• Microsoft 365 security reviews
• Microsoft Defender for Office 365 configuration
• Safe Attachments and Safe Links policies
• Endpoint protection and monitoring
• Microsoft Intune device management
• Patch and update management
• Multi-factor authentication and conditional access
• Security-awareness training
• Backup and disaster-recovery planning
• Incident response and ongoing managed IT support

We can review how documents enter your business, identify gaps in your existing security and introduce practical controls that protect employees without making routine work unnecessarily difficult.

Do Not Let a Familiar File Format Create an Unfamiliar Risk

PDFs are an essential part of everyday business communication, but they should not be trusted automatically.

The strongest defence combines secure email filtering, fully updated software, protected viewing modes, endpoint monitoring, access controls and employees who know how to recognise and report suspicious activity.

To review your email security, endpoint protection or Microsoft 365 configuration, book an appointment with Hamilton Group’s experts or call us on 0330 043 0069.