Can PDF Files Have Viruses? What Your Organization Needs to Know

How attackers infect PDFs with viruses & what you can do about it

Learn how attackers infect PDFs with malware, real-world case studies, warning signs, and best practices to secure your files from PDF-based threats.

   Can you get a virus opening a PDF file?

While many assume a PDF is just text and images, the file type can, in fact, contain malicious code and viruses. PDF-based malware has been a common attack vector for well over a decade, with dozens of high-profile examples of exploitation in the wild. Without the right education or mitigations, a routine action such as opening an invoice can lead to a major security incident.

In this guide, we’ll cover what organizations need to know about this threat, covering:

1. The methods attackers use to infect PDFs
2. Types of malware found in malicious PDF files (case studies)
3. Warning signs that a PDF may be infected
4. How to scan a PDF for viruses before opening
5. Best practices to protect yourself from PDF threats
6. How to distribute PDFs securely without malware risk

   How can PDF files be virus-infected?

There are four primary methods attackers use to infect users with malware via a PDF file:

1. By embedding malicious code or files: While PDFs are primarily about text and images, you can embed pretty much anything in them, including JavaScript code, which, if the Reader is configured poorly, can execute when the user opens the PDF or interacts with a form. Such code typically isn’t malware in itself. Instead, it fetches the payload from a remote server, often with a complex multi-chain process that makes it more difficult for antivirus tools to notice.
2. Exploiting parser vulnerabilities in the PDF reader: Adobe Reader has had hundreds of vulnerabilities over the years. Famously, in 2018, 50 critical vulnerabilities were discovered in 50 days. For example, a zero-day flaw discovered in 2026 enabled attackers to use a maliciously crafted PDF to steal data from compromised systems without user input. Such attackers usually exploit a vulnerability to trigger memory corruption and code execution.
3. Through phishing links: The most common and likely most effective way of attacking users via a PDF file is a tried-and-tested phishing link. Attackers craft a PDF that looks legitimate with a button such as “View document” or “Verify account” that takes users to a fake log-in site that steals their credentials or a site that triggers a malware download.
4. By not sending you a PDF at all: While it’s less common now that antiviruses are more sophisticated, some attackers still disguise .exe files as PDFs. If the recipient has “view file extensions” turned off in their file browser, they might not realize that “invoice.pdf” is “invoice.pdf.exe”.

As you can imagine, these multiple attack vectors make PDFs an ever-present threat that organizations must remain vigilant and educated on.

   What types of malware are found in PDF files?

Theoretical threats are all well and good, but what do PDF-based attacks look like in the wild? Are they really as damaging as some people would have you believe? Let’s look at some case studies to find that out.

The Ratty RAT campaign

In 2025, businesses in Italy were hit by a distributed email campaign that used PDF files to deliver Remote Access Trojans (RATs) capable of logging keystrokes, exfiltrating data, executing remote commands, and more.

By using a legitimate Spanish email provider, attackers were able to pass SPF checks on email inboxes to deliver fake invoice PDFs to their targets. Upon opening the PDFs, the user would see a “file not showing correctly” button with a link to a Dropbox-hosted HTML file named “Invoice”. This led to a fake CAPTCHA, which routed users via an Ngrok tunnel to a .jar file disguised with the payment reference number, which deployed the trojan.

These types of disguised, multi-stage attacks are very common in PDF malware. Attackers frequently use well-known hosts to lend credibility and use phishing links rather than directly embedding malware for lower detection rates and more frequent success with non-educated users.

The Danish Maritime Authority hack

In 2012, an employee at the Danish Maritime Authority opened a virus-laden PDF file attached to an email. Within minutes, attackers had backdoor access to his computer and the rest of the network. They later utilized it to infect thirteen additional devices and break into the Business Ministry’s IT system, targeting sensitive information on Danish shipping companies and the merchant navy. Authorities did not notice the breach until two years later, when an American IT expert tipped them after noticing DMA files sitting on a known malicious US server.

To perform the attack, a suspected state-sponsored hacker embedded malicious code in the PDF, likely exploiting an Adobe Reader vulnerability to trigger a memory-corruption vulnerability in the PDF reader that allowed it to escape the sandbox and run shellcode at a user level to deploy the backdoor.

The 2017 Locky campaign

In April of 2017, Cisco Talos spotted use of PDFs as the initial attack vector in a large wave of Locky ransomware attacks. The attacks started with over 35,000 emails hitting targets’ inboxes, each containing PDF attachments related to various payments/receipts. Upon opening the PDF, it opens an embedded Word document, which socially engineers the user into allowing editing, after which it executes a Visual Basic macro that downloads the ransomware from an infected website and encrypts the user’s system files.

   Warning signs that a PDF may be infected

As we’ve covered, attackers now use sophisticated, multi-stage attacks that help them evade detection by antivirus scanners and email filters. One thing that’s much harder to bypass, though, is a human who knows what to look for. There are several common tip-offs in infected PDF files that organizations can train employees to recognize:

• Context clues: Unexpected receipts, invoices, and scans, particularly when combined with little body text or pushes to “act fast”, should bring up red flags. This is particularly true in non-targeted attacks, where receipts and invoices typically have random numbers with no relation to the recipient’s work.
• File size: Look at the file size of the PDF attachment. Does a tiny, 3 KB file size make sense for an invoice? Or a 100 MB file for a receipt? These are signs the document may just be there to redirect the user to malware, or, for large file sizes, have an embedded document or other payload.
• File extensions: Turning file extensions on in your file browser more or less eliminates the threat of fake PDFs. If the file explorer shows “filename.pdf.exe”, run a mile.
• JavaScript or file open warnings: If a PDF asks you to allow JavaScript execution or open another file, the response should always be “No” until you’ve investigated it further. It’s likely malicious.
• Weird web links: In general, treat any link inside a PDF file as potentially malicious. If the PDF file is telling you that you need to click a link to gain access to its contents, then it’s definitely a virus.

In general, if there’s any doubt, users should be directed not to open the file and contact the IT department.

   How to scan PDF files for viruses before opening

Scanning a PDF file for a virus if you’re suspicious is never a bad idea. However, it should be noted that a virus not showing up on a virus scanner doesn’t mean it’s not there. Even heuristic or behavioral virus scanners can miss sophisticated, multi-stage attacks.

That said, there are two primary ways to scan a PDF file for viruses:

1. Right-click the file and choose “Scan with Windows Defender (or your other relevant virus scanner)”.
2. Go to VirusTotal.com and upload the file. Check the results from its 70+ virus scanners and check the behavior section to examine what the virus actually does in a sandbox. Note: Do not upload files with potentially sensitive information to VirusTotal or any other online virus scanner.

Virus Total’s sandbox feature is particularly useful since it shows a clear trail of everything the PDF tries to do after it’s opened. However, determining what behavior is malicious can be extremely difficult for users who don’t work in the field. It must therefore be combined with education and prevention.

   Best practices to protect yourself from PDF threats

While PDF malware risks are difficult to eliminate entirely due to the sophisticated nature of some attacks, there are several best practices you can follow to reduce the risks:

1. Keep your PDF reader patched: Many PDF attacks use known reader vulnerabilities as part of their attack chain. You should update your PDF reader as frequently as you can, preferably enabling automatic updates.
2. Disable JavaScript execution: Go to Preferences > JavaScript in Acrobat (or similar reader) and uncheck “Enable Acrobat JavaScript”. Very few PDFs use JavaScript, yet it’s one of the most common and powerful attack vectors.
3. Don’t auto-launch embedded files: Go to Preferences > Trust Manager in Acrobat and untick “Allow opening of non-PDF file attachments with external applications”. Again, this is rarely used by legitimate PDFs but commonly used by malicious ones.
4. Use a sandboxed reader: Sandboxing makes it much harder for attackers to succeed by isolating what happens inside the PDF from the rest of the system. It should be turned on by default in Adobe Reader, but some lightweight PDF readers don’t support this functionality.
5. Pay attention to context cues: Unexpected attachments, senders, subject lines, urgent language, mismatched file details. Pay attention to contextual details to help flag suspicious files.
6. Scan files before opening: Use an antivirus tool to scan files, preferably one that lets you examine their behavior in a sandbox.
7. Don’t rely on password protection: Some people use password protection not just for security but to signify legitimacy. i.e. “if the file has this password, it must have come from someone internal”. PDF passwords, however, can be cracked, shared, or socially engineered. Don’t rely on them to prevent unauthorized access or verify legitimacy.
8. Make encryption a standard: Encryption keys are much harder to crack or obtain than passwords. Using a system like PGP ensures that an attacker needs to know both the sender’s private key and the recipient’s public key to make the PDF appear legitimate. Not impossible, but an additional obstacle compared to plaintext or password protection. Ideally, encryption in an organization should be centrally managed and keys never exposed to users so that they cannot share or leak them.

Following these best practices will significantly reduce the attack surface, making it harder for a malicious PDF to reach or compromise you. Protecting the recipient is just one part of the equation, though. If you’re distributing PDFs or managing an organization that does, you also need to ensure that your files aren’t tampered with or weaponized.

   How to distribute PDFs securely without malware risk

Locklizard Safeguard PDF DRM allows you to distribute PDFs without the risk of malware, interception, leaks, or unauthorized use. When you encrypt a PDF with Safeguard, you can choose to have it strip any JavaScript, attachments, or other objects that may be used to harm recipients. Once encrypted, the protected document file cannot be edited by anyone, including the document owner, and it can only be accessed by those with a valid license pre-installed on their device. In other words, it’s impossible for an attacker to intercept your PDF, modify it to add malware, and continue to distribute it.

But what about documents an attacker creates to specifically target employees? By enforcing Locklizard as a standard, you ensure that any unprotected PDF that reaches employees’ inboxes can be treated as suspicious. Locklizard PDFs, meanwhile, are very difficult to spoof or exploit. Since users must pre-install a license for a specific company to access their PDFs, an attacker couldn’t just protect a malicious PDF with Locklizard and distribute it — users wouldn’t be able to open it unless they also installed a valid license. Further, Locklizard’s custom viewer application is custom-built to be secure and stable. It is entirely separate from the vulnerability-prone Acrobat and does not allow JavaScript or plugins.

For businesses, all of this makes training very simple. You just need to teach employees:

1. Not to open plaintext PDFs without approval
2. Not install additional licenses
3. Check for the .PDC file extension

None of these require the sort of nuanced judgment calls common in standard PDF security. If it’s not a .pdc file, from a source they already trust, that’s licensed for the viewer they’re using, it doesn’t get opened. In the process, organizations benefit from all the other features of the DRM: the ability to stop unauthorized editing, sharing, screenshots, and printing, as well as control who can view a document, for how long, and from where.

Start a 10-day free trial of Locklizard Safeguard DRM to test these features yourself, or book a demo to discuss how we can help secure your organization’s specific workflow and compliance needs.

   FAQs

Can a PDF file have viruses on it on Mac?

Yes. While most viruses are targeted at Windows users, PDFs can still absolutely target Mac devices, particularly in sophisticated targeted attacks.

Can a PDF file from an email have a virus?

Yes, in fact, emails are by far the most common way to spread PDF-infected viruses.

Can you get a PDF virus on Android?

It’s less common for PDF viruses to target mobile devices, but it’s certainly possible, particularly with targeted attacks.

Can you virus-scan a password-protected PDF?

It depends. If the PDF only has a permissions password, it should scan relatively well. PDFs with an open password, however, are encrypted, and the virus scanner therefore cannot read and assess their content. Only scanners that have pre-saved a hash of that specific PDF will detect it.

Can I get a virus from a PDF on Dropbox?

Yes, by either downloading it or by following a link in the PDF to a site that downloads the virus.