The PDF That Scanned Clean Because Nobody Could Read It

The attachment scanner returned a verdict of clean. The incident resolved as phishing anyway. That contradiction is the whole story here, because the file scanned clean for the worst possible reason: nobody, human or machine, could read what was inside it without the attacker's cooperation.

The lure was a payroll exception notice. The subject line announced a direct deposit remittance batch exception, the kind of automated payroll message a busy HR or accounts team sees constantly and clicks through on reflex. The display name was engineered to feel personal, embedding the recipient's own name so the message read as though it had been generated specifically for them. It landed in the inbox of a VP of Human Resources at a mid-size manufacturer, then propagated to two more mailboxes in the same organization before it was mitigated.

Two layers of blindness, stacked

Most attachment-based phishing gives a scanner something to chew on. This one gave it nothing, twice over.

Layer one: the attached PDF was password-protected. When the analysis tooling tried to parse it, it got back "Incorrect password" and stopped. Encryption is a legitimate feature, which is exactly why it makes such a clean evasion tool. A scanner cannot extract text, cannot render pages, cannot enumerate embedded objects. The file is a locked box. The attacker solved the obvious problem, that the recipient also needs to open the box, by supplying the password directly in the email body. The filename and the password were even numerically linked (ATT008745538.pdf, password 8745538), a small touch that makes the pairing feel like a system-generated reference rather than an attacker's key.

Layer two waited inside the box, in case a scanner ever got in. The PDF carried 23 annotation objects, and one of them held a /URI link action. Instead of storing the destination as readable text, the attacker stored it as a hex-encoded blob beginning 780fb979ba4c.... A static tool grepping for http or a plaintext hostname finds nothing. When analysts attempted to decode the hex, it resolved to non-UTF-8 binary rather than a URL, because the string sits inside the encrypted document and cannot be cleanly recovered without first defeating the encryption in an isolated sandbox. The true landing page was never resolved by static analysis, and this write-up will not pretend to know it. That opacity is the point. The destination stays hidden from tooling right up until a user, on a normal endpoint, does the decoding for free by opening the file and clicking.

This maps cleanly to MITRE ATT&CK T1566.001, spearphishing attachment, with the payload itself operating as T1204.001, user execution of a malicious link. The Verizon 2026 Data Breach Investigations Report puts malware-laden messages at roughly 10% of the gateway attack mix against 80% plain phishing, and attachment tradecraft like this is precisely how that smaller slice stays effective: it is built to survive the scan.

See Your Risk: Calculate how many threats your SEG is missing

The envelope told the truth the payload wouldn't

If the attachment was a locked box, the mail headers were wide open, and that is where this message fell apart.

The visible sender was an aged, unrelated Italian domain that had no business sending North American payroll notifications. It appeared as the From address and Return-Path, but SPF softfailed against it: the originating IP was not authorized to send on its behalf. The message routed through a relay tied to a DNS hosting provider, not a recognized email security gateway, so there was no legitimate forwarding service to explain away the authentication break.

Then the mismatch that really gave it away. The message was DKIM-signed, but the signing domain was halanus[.]com, not the domain in the visible From, and the signature failed to verify. The relay's own headers named donotreply@halanus[.]com as the authenticated sending identity. So the address the recipient saw, the domain that signed the mail, and the domain the message actually authenticated as were three different things. DKIM exists to bind a message to the domain that claims to have sent it. When the signing domain has nothing to do with the visible sender and fails to verify on top of that, the sender's claimed identity has collapsed. DMARC failed as a result, and the whole configuration reads as T1036.005, masquerading, in action.

Individually, a softfail or a first-time sender is noise. Stacked together, with unrelated brand names paired to an unrelated sending domain and a mail client already flagging an unfamiliar external sender, the signal is unambiguous. This is why an attachment verdict cannot be the deciding vote. Advanced malware and URL protection has to account for the case where the payload is deliberately unreadable, and our Adaptive AI does that by weighing sender authentication, first-contact behavior, branding coherence, and message intent together. The static scan came back clean; the behavioral and authentication picture came back phishing. The behavioral picture won.

The takeaway for defenders

A clean attachment verdict on a password-protected or obfuscated file is not a safety signal. It frequently means the scanner was locked out, which is the outcome the attacker was buying with the encryption. CISA's phishing guidance makes the same point in operational terms: defense has to assume some messages will slip the perimeter and layer detection accordingly.

Three concrete moves. Treat unexpected password-protected documents, especially anything invoking payroll or payment changes, as suspect on arrival, and train finance and HR teams that a password supplied in the email body is a red flag, not a convenience. Weight authentication outcomes heavily, and pay specific attention to DKIM-signing-domain versus From-domain mismatches, because that gap is hard for an attacker to close. And do not let a single static verdict override a stack of behavioral signals. IRONSCALES data shows SEGs miss roughly 67.5 phishing emails per 100 mailboxes every month, and messages engineered to scan clean are exactly the ones that make up that gap.