The Whole Page Is the Button: A PDF Click Trap

A high‑severity phishing campaign used an image‑based PDF with an invisible full‑page pushbutton wired to embedded JavaScript that opens a Firebase-hosted page impersonating Adobe to harvest credentials; SPF/DMARC passed meaning authentication checks did not block delivery, and text obfuscation (soft hyphens and HTML comments) evaded keyword and address extraction. The report includes IOCs (URL, file name, hash, sender domain, and IPs), MITRE mappings, and mitigation guidance emphasizing geometry-aware PDF inspection and normalization of text before rule matching.