Scammers Leverage PDFs And Calls With AI

Cybersecurity researchers at Cisco Talos have uncovered a rising wave of callback phishing scams that use PDF attachments to bypass traditional email security and trick victims into calling fraudulent tech support numbers. Between May and June 2025, attackers found impersonating trusted brands such as Microsoft, Adobe, and DocuSign to deceive users into engaging in voice-based social engineering. 

Known as callback phishing, this attack method involves sending a phishing email with a seemingly legitimate PDF attachment. The PDF contains an attacker-controlled phone number, often supplemented with a QR code to further obscure detection. Once the victim calls, threat actors posing as customer service agents manipulate the caller into revealing sensitive data or installing malware. The use of Voice over IP (VoIP) numbers-difficult to trace-adds an additional layer of anonymity for scammers. 

Key threat elements identified by Cisco Talos: 

• PDF phishing: Malicious phone numbers and QR codes are embedded in PDFs to evade detection by standard email filters. 

• Live phone scams: Attackers rely on voice interactions to build trust and apply emotional manipulation in real-time. 

• Use of VoIP: Scammers exploit untraceable VoIP numbers to mask their identities. 

• Bypassing enterprise security: Mobile devices, often used to scan QR codes, typically lack enterprise-grade protections, making them prime targets. 

The sophistication of these phishing tactics signals a broader trend in cybercrime. Where generative and interactive tools are used to mimic legitimate communications and exploit user trust. Enterprises are urging to enhance employee awareness, implement advanced email filtering that scans attachments more thoroughly, and deploy AI-driven anomaly detection systems to detect evolving threats. 

Source: 

https://www.techradar.com/pro/security/scammers-are-once-again-abusing-pdfs-to-trick-victims-into-calling-fake-support-numbers