PDFs: Portable documents, or perfect deliveries for phish?

Cisco Talos analyzes a surge in brand impersonation email threats that use PDF attachments to deliver QR-code phishing and telephone-oriented attack delivery (TOAD), including VoIP callback scams, PDF annotation abuse to hide links, and misuse of Adobe e-signature services. The report details trends across May–June 2025 showing frequently impersonated brands (e.g., Microsoft, DocuSign, PayPal, Geek Squad), highlights reuse of attacker-controlled phone numbers (treated as IOCs), and explains how these techniques evade traditional email defenses, underscoring the need for enhanced brand impersonation detection.