In recent years, PDFs emerged as a primary vector for attack chains, with threat actors exploiting their ubiquity and complexity to deliver malware through sophisticated social engineering tactics.
Recognizing this escalating threat, Check Point introduces PDFguard, an advanced AI engine designed to prevent malicious PDFs that employ deceptive tactics. Impressively, PDFguard has identified 25% more malicious files than its predecessor, most of which have never been seen before!
The Growing Threat of Malicious PDFs
Organizations generally use email and PDFs in standard business communications and are widely regarded as safe and reliable.
This false sense of safety has resulted in 68% of malicious attacks delivered through email last year, with 22% of these are PDF-based attachments, according to Check Point Research.
PDFs are particularly attractive to attackers due to their complex structure, which allows them to conceal harmful links, malicious code, or other dangerous content. By leveraging users’ familiarity with PDFs and using social engineering techniques, attackers increase the likelihood of deceiving recipients.
These malicious PDFs are used not only in phishing campaigns but also as part of multi-stage attack chains that can ultimately lead to serious threats like ransomware infections. Given their ubiquity in business environments, PDFs have become a significant vector for cyber threats.
Introducing PDFguard
PDFguard uses a multi-layered, AI approach to analyze PDFs for indicators of malicious behavior. Its capabilities include:
- Natural language processing (NLP):Detects social engineering language designed to trick users into clicking malicious links or downloading harmful content.
- Image and structural analysis:Examines the internal structure of PDFs to identify anomalies and hidden threats.
- Cross-domain threat detection:Inspects embedded URLs and QR codes for malicious redirection.
- Dynamic analysis:Executes the PDF in a sandbox environment to observe real-time behavior, such as unauthorized downloads or script execution.
Above are some of many extraction features that are constantly being upgraded.
Real-World Protection: Case Study
The PDF displayed a blurred image with a download button, luring the victim to click it to review a purchase order. Upon interaction, the link directed users to an external URL ( that downloaded a 7zip archive containing a VBScript file. This script acted as a dropper, delivering the RAT attack.
PDFguard’s dynamic analysis prevented this attack by identifying the following malicious behaviors:
- Visual social engineering: The blurred content simulates a legitimate invoice or purchase order, creating urgency and trust.
- Deceptive branding: Usage of PDF icon and Adobe logo reinforces false legitimacy.
- Cross-domain engine: A malicious URL, flagged by Check Point’s ThreatCloud AI URLX as a C&C domain.
New forensics integrated into TE report
Each malicious PDF is accompanied by a comprehensive threat emulation (TE) report, which includes:
- AI insights from the engine.
- MITRE ATT&CK matrix: Highlighted tactics and techniques used in the attack.
- Visual evidence: Emulation video and snapshot of the attack.
- Advanced forensics: A timeline of events during the emulation process.
As cyber threats evolve, particularly those exploiting common file formats like PDFs, it’s imperative to adopt advanced security solutions. PDFguard represents a significant advancement in detecting and preventing PDF-based malware, leveraging AI to stay ahead of sophisticated attack vectors. By integrating PDFguard into your cyber security strategy, you enhance your organization’s resilience against emerging threats.
Check Point customers using Quantum and Harmony products with Threat Emulation activated are protected against the campaigns detailed in this report.
To learn about Check Point threat prevention, schedule a demo or a free security checkup to assess your security posture.