The Blank PDF That Signed Its Own Generator's Name

A targeted phishing email impersonating a national tax authority delivered an 8,692-byte PDF that passed superficial checks (no JavaScript, no URIs, blank Info dictionary) while embedding a signed C2PA provenance manifest naming the generator and an OpenAI OpCo certificate; the message included a redirecting Download PDF link and credential-theft intent. The report details metadata discrepancies, provides IoCs (domains, URLs, file hashes), notes authentication gaps (DKIM-only/ SPF=none, DMARC p=NONE), and recommends adding provenance checks to attachment triage and hunting for DKIM-only DMARC passes.