Microsoft, PayPal, DocuSign, and Geek Squad faked in callback phishing scams

Researchers at Cisco Talos observed a May–June phishing campaign impersonating Microsoft, NortonLifeLock, PayPal, DocuSign, and Geek Squad that uses blank-email bodies with auto-loading PDF attachments containing phone numbers, links, and malicious QR codes; victims are directed to call attacker-controlled numbers (callback phishing) or visit fake login pages, risking credential theft and malware installation. The report highlights detection evasion (PDFs that render as email content) and recommends vigilance for urgency, unexpected attachments, unknown sender addresses, QR codes, and use of active antimalware with web protection.