The PDF That Let the Human In and Locked the Sandbox Out

Attackers used a legitimate-seeming, password-protected PDF sent from a likely compromised Georgia Department of Education account with the passcode in the email body to bypass automated scanners and sandboxes; although SPF/DKIM/DMARC and URL checks passed and static scanners flagged the file as clean, behavioral AI detected the pattern (protected attachment + passcode in body + unusual sender/To: behavior) and quarantined two Florida law-firm mailboxes within 26 seconds, while the payload remains unconfirmed due to encryption.