Why are hackers sending PDFs that look like Microsoft or DocuSign emails asking me to call a phone number?
Cybercriminals are now using PDF attachments in phishing emails that impersonate trusted brands like Microsoft, DocuSign, PayPal, and NortonLifeLock to trick users into calling fake support numbers. This growing attack, called Telephone-Oriented Attack Delivery (TOAD) or callback phishing, persuades victims to dial a VoIP number where attackers act like customer support agents. They steal credentials, install malware, or gain remote access. These PDFs often include QR codes, fake annotations, or use real brand logos, making them hard to detect. Users should avoid interacting with unknown PDFs, scanning suspicious QR codes, or calling unfamiliar numbers mentioned in email attachments.
Quick answer: These emails carry a PDF that imitates brands like Microsoft, DocuSign or PayPal and urges you to call a support number. This is callback phishing, also called TOAD. The email body is often blank, so filters miss it. On the call, scammers pressure you for access or payment details. Never call numbers from attachments; use the company's official website.
Key takeaways
- This is callback phishing: the email contains almost no text, so the scam depends on you phoning the number.
- Mail filters often miss it because the lure is inside a PDF image and the phone number is not a link.
- Verify any invoice or subscription claim by logging in to the vendor's real site, not by calling a number in the attachment.
Table of Contents
- What’s Going On?
- How the Scam Works
- Why Is This Scam Dangerous?
- Scam Techniques vs. Impact and Easy Fixes
- Simple Steps to Stay Safe
- Conclusion
What’s Going On?
Between May and June 2025, cybersecurity researchers at Cisco Talos discovered a wave of phishing emails that use malicious PDF attachments to impersonate trusted brands like Microsoft, DocuSign, NortonLifeLock, PayPal, and Geek Squd. These PDFs prompt victims to call fake support phone numbers, a rising trend called Telephone‑Oriented Attack Delivery (TOAD) or callback phishing.
How the Scam Works
How Does Impersonation Through PDFs Work?
The emails often contain a blank body; the PDF itself displays official logos, urgent messages (e.g., “Paycheck Increment” notice), QR codes, or sticky-note annotations. These tactics bypass email filters due to the content being hidden inside the attachment.
What Is Callback Phishing (TOAD)?
When users open the PDF, they’re encouraged to call a number, often a VoIP line, to resolve a fictional problem. Attackers on the call then pretend to be official reps, using scripted dialogue, hold music, and caller ID spoofing to gain trust. They may steal passwords, install malware, or create remote access on devices.
Why Is This Scam Dangerous?
Live Interaction Boosts Trust
Unlike regular phishing links, this scam uses real-time human interaction, making it easier to manipulate victims emotionally.
PDF & QR Code Evasion
Embedding the malicious content inside PDFs and QR codes makes detection harder, as many email scanners don’t scan inside attachments or use OCR technology.
Anonymity with VoIP
Attackers use recycled VoIP numbers to stay anonymous and maintain the illusion of legitimacy over multiple days.
Spoofing Internal Mails
Attackers exploit Microsoft 365 Direct Send to spoof internal addresses and bypass email filters, making these phishing messages more convincing.
Scam Techniques vs. Impact and Easy Fixes
| Scam Feature | Why It's Dangerous | How to Protect Yourself |
|---|---|---|
| PDF attachments | Bypass text filters, mimic brand identity | Disable auto-open; preview before launching |
| QR codes | Hidden malicious links | Avoid scanning with phone; hover to check URL |
| VoIP callback numbers | Hard to trace, seem professional | Don’t call unverified numbers; confirm via official support site |
| Phone social engineering | Live manipulation increases success | Verify caller credentials; ask for details via official channels |
| M365 Direct Send spoofing | Bypasses normal anti-spam protections | Use strict DMARC, DKIM, SPF and internal filtering |
Simple Steps to Stay Safe
-
Never open PDFs from unknown or suspicious emails.
-
Avoid calling phone numbers inside unsolicited PDFs, confirm via official websites.
-
Don’t scan QR codes in unexpected attachments.
-
Use email security filters that analyze attachments and VoIP call metadata.
-
Train staff to recognize callback phishing and verify requests independently before responding.
Conclusion
This emerging phishing method, callback phishing via malicious PDFs, is gaining traction because it blends technical evasion with psychological manipulation. Attackers weaponize urgency, brand familiarity, and human trust to trick victims into calling and self-compromising. Keeping your defenses strong means being aware, cautious, and always verifying, especially when communication moves from screen to phone.
To take this further with guided labs and an instructor, see our SOC analyst exam preparation.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
