The Whole Page Is the Button: A PDF Click Trap

A one-page PDF landed on a shared ordering mailbox at a mid-size business. It rendered as a flat image of a statement. No form fields, no visible link text, no button, nothing to hover over.

The entire page was the button.

The platform verdict on that attachment was malicious, so this is not a story about something slipping through. It is a story about the mechanism, which a structural read of the file calls inert three times before it finds the trap.

A Pushbutton Sized to the Media Box

Read object by object rather than summarized from a scanner report, the 421,910 byte file has a page object listing a single annotation: /Type /Annot /Subtype /Widget with field type /Btn and a field flag value of 4, the pushbutton bit. Its rectangle is /Rect [ 0 0 595.32 841.92 ]. That is not a button on the page. That is the page, corner to corner, the exact dimensions of the media box.

The annotation's /A entry points at a second object, /S /JavaScript with a /JS string. Decoded from the PDF octal escapes, the script carries no obfuscation:

try { app.launchURL('hxxps://acrobat-v215219-plug[.]web[.]app', true); } catch (e) { app.alert('Error: ' + e.message); }

One call, wrapped so a failure surfaces as a tidy dialog rather than silence. The destination is a Firebase application host, where the only attacker-chosen string is the subdomain label, and that label borrows the Acrobat name to sell an Adobe-branded credential page to somebody who just clicked inside a PDF reader.

Three Things the File Does Not Contain

There is no /OpenAction on the document catalog and no /Names /JavaScript document-level name tree anywhere in the file. Those two entries are how a PDF runs script the instant it opens, and a direct string search confirms both are absent. The redirect does not auto-fire.

There is also no /AcroForm dictionary, even though a button field widget sits right there on the page. Legitimate fillable documents register their fields there, and this one does not, the signature of an overlay hand-assembled onto an existing page rather than a form built by an authoring tool.

So a structural review finds an image-based single page, no auto-run action, and no registered form. Three reasons to file it as a scanned document that happens to be a bit large.

The click requirement is not the mitigation it sounds like. MITRE tracks this as user execution of a malicious link, and user execution implies a decision, a link the victim chose. Here the annotation covers every pixel: click to bring the window forward, dismiss a tooltip, or select a line of text, and the action fires. Practically the behavior is indistinguishable from automatic, and technically it is a click, so checks hunting for auto-run entries return clean.

Two Obfuscations Stacked in the Body Text

The visible text of the email carrying the file is broken mid-word, repeatedly, by soft hyphens. Please, find, attached, order, statement, reference, correct, business: every one split at least once, some three or four times. A soft hyphen renders as nothing unless a line break needs it, so the message reads normally to a person while a keyword filter sees none of those words.

The signature block uses a different technique for a second contact address, chopped into three fragments by empty comment markers in the HTML source that the mail client discards on render. The recipient sees one clean address. A scanner extracting addresses from the raw source finds three meaningless strings. Two methods, two different parsers, one message. MITRE catalogs the family as obfuscated files or information, and the 2026 Verizon Data Breach Investigations Report puts phishing in 16% of breaches as the initial access vector, with the human element in 62%, the layer both tricks are built to reach.

The Authentication Was Not Bypassed, It Was Owned

The sending domain was registered in 2021 and was live when the message went out. Its own SPF record explicitly authorized the sending host, listing a specific IPv4 address plus an include for a large hosting provider. That is not shared-hosting collateral damage: publishing an SPF record means controlling the DNS zone, so the domain belonged to the operation.

SPF passed. DMARC passed under a quarantine policy with the header sender aligned, and with no signature to evaluate, alignment carried the result alone, exactly as RFC 9989 specifies. The path was ordinary throughout: a public cloud instance submitting to a commercial hosting relay, out through that provider's egress, into a third-party security gateway, on to Microsoft 365, collecting a passing ARC seal at each hop. Composite authentication landed at the top of its scale. The domain has since lapsed into a redemption period with expired name servers, a snapshot from weeks later that fits an aged asset woken for one campaign and dropped.

Reputation had nothing to work with either: the only links in the body belonged to the external-sender warning banner, and the signature named a company whose domain resolves nowhere.

What was left to detect was behavior: a first-time sender, an order and statement pretext with no prior thread, text mangled below the reading layer, and a one-page attachment hiding a full-size action. Themis, the Adaptive AI analyst inside the IRONSCALES platform, resolved the message as phishing autonomously, mitigation recorded roughly two seconds after receipt, one mailbox affected, no analyst step in between.

See Your Risk: Calculate how many threats your SEG is missing

The Document Was Older Than the Campaign

The metadata names Microsoft Word 2016 as creator and producer, with timestamps of 2024-07-25, close to two years before delivery in mid-June. The page is an old shell, and the annotation welded onto it is what made it a weapon. A shell like that gets a fresh destination whenever the last one burns.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.001 Phishing: Spearphishing Attachment for delivery of the weaponized one-page PDF under an order and statement pretext.
• T1204.001 User Execution: Malicious Link for the click-triggered browser launch, with the trigger enlarged to the full page so the click is unavoidable.
• T1027 Obfuscated Files or Information for the soft hyphens fragmenting body text and the comment-split address in the signature.

Closing the Invisible-Annotation Gap

Grade annotations by geometry, not just by presence. A button widget whose rectangle matches the page dimensions has no legitimate reading, and neither does a button field that no form dictionary registers. Reporting that a PDF contains JavaScript, without reporting what reaches it and how large the trigger is, answers the easier question. That is the difference advanced malware and URL attack protection has to make on a file no signature matches.

Stop treating a missing auto-run entry as reassurance. No open action and no document-level script tree is where a lot of triage stops. It should be where triage starts asking what the interactive objects do. CISA's phishing guidance is direct: controls built to recognize known-bad artifacts have nothing to recognize when the artifact is a legal construct used dishonestly. The landing page only matters if the click lands, which is where credential harvesting protection works.

Normalize text before you match on it. Strip soft hyphens, zero-width characters, and comment markers, then analyze what a human would read. Otherwise every keyword rule, address extractor, and phishing heuristic grades a string the recipient never saw. The FBI's 2025 Internet Crime Report logged $20.877 billion in reported losses, and the front door on much of it is still an attachment opened at work. This file only had to work once.