Nothing spectacular here

Two of these attacks were empty messages containing a branded PDF.

The PDFs contained very appreciative messages:

Examples:
"We are pleased to inform you that, effective 01 January 2026, your base salary will be adjusted. This adjustment recognizes your valuable contributions to the company and reflects our commitment to maintaining fair, market-aligned compensation."

"Thank you for your hard work and continued commitment. Your dedication has not gone unnoticed, and as a reflection of your contributions, we’re pleased to acknowledge this with a salary increment. Your efforts truly make a difference, and we’re excited to move forward into a new month with fresh goals, continued teamwork, and shared success"

Sidenote: I think many HR departments could learn from the wording used.

Follow by the instructions to review this through the include QR code and to keep the message confidential.

Sidenote: Secrecy is a common technic used by attackers to increase the success rate. A review by a second pair of eyes would improve the chance to encounter a "Wait, this looks too good to be true" revelation.

The QR code was split into two images to hide it from content filters. They would need to stich the images correctly before they could detect the URL hidden in the QR code

The green bar stating that "E-mail was scanned by mail security and is believed to be clean." is also a nice psychological touch. What could possibly go wrong if the email was checked by security 😬

#Phishing