MalDoc in PDF: A Novel Method to Distribute Malicious Macros

Since Microsoft disabled Macros by default, threat actors have actively experimented with alternative attack methods. They utilize various other file structures to distribute malicious content to their victims. Notably, notorious malware strains like Emotet, QakBot, and IcedID have already leveraged such tactics. 

Recently, researchers unveiled a novel technique for evading antivirus detection: embedding a malicious Microsoft Word file within a PDF file. This devious method, coined “MalDoc in PDF” by JPCERT/CC, reportedly featured in an observed …

attack default disabled emotet file icedid macros maldoc maldoc in pdf malicious malware microsoft novel pdf qakbot researchers tactics threat threat actors