The PDF That Scanned Clean Because Nobody Could Read It

A payroll-themed spearphishing campaign delivered a password-protected PDF (password provided in the email) that concealed a hex-encoded malicious URI inside a PDF annotation; static scanners returned a clean verdict because the file was encrypted and the payload was obfuscated, but the message was flagged as phishing due to SPF softfail, a failed DKIM signature from an unrelated signing domain, sender/branding mismatches, and first-contact behavioral signals — the attack aimed to harvest credentials via user interaction.