A Salary Notice Whose Effective Date Was Its Build Clock

A targeted spearphishing campaign delivered personalized two-page PDF payroll notices to four mailboxes at a UAE food importer; the PDFs contained per-recipient merge fields (including an EFFECTIVE DATE timestamp rendered to the second), had a /CreationDate one second later, and instructed recipients to scan a verification code — despite containing no links, JavaScript, or automatic actions. The messages were quarantined after human review; the report provides IOCs (document strings, PDF metadata, producer string 'Qt 4.8.7', header urgency flags, and subject/display-name patterns) and documents authentication anomalies where an initial origin failed SPF/DKIM/DMARC but a later Microsoft hop produced a passing verdict.