We’re all used to getting emails with attachments—an invoice, a receipt, a purchase order. Most of the time, they’re harmless.
But according to cybersecurity company Malwarebytes, criminals are now sending fake “PDF” files that aren’t actually documents at all. If opened, they can give hackers remote control of your computer.
Let’s break this down in simple terms.
What’s Happening?
You receive an email that looks normal. It might say:
- “Here’s your invoice”
- “Purchase order attached”
- It may even look like it’s from a real company
Instead of attaching a file directly, the email includes a link. When you click it, you download what appears to be a PDF file.
But here’s the trick:
- It looks like a PDF.
- It has a PDF name.
- It even has a PDF icon.
But it’s not a PDF.
When you double-click it, instead of opening a document, your computer quietly creates a hidden “virtual drive” and installs malware (harmful software) in the background.
You won’t see anything unusual.
What Does This Malware Do?
The program being used in this campaign is called AsyncRAT, a remote access tool. That means:
- Hackers can see what you type.
- They can steal saved passwords.
- They can access your documents and photos.
- They can take screenshots.
- In some cases, they can even activate your webcam.
- They may use your computer to attack other devices in your home.
And the scary part? The malware runs quietly in the background and hides inside normal Windows processes, which makes it harder to detect.
Why This Scam Is So Sneaky
Each step looks “normal” on its own:
- The email looks like routine business.
- The file looks like a PDF.
- Windows behaves the way it’s designed to.
That’s what makes this dangerous. Nothing jumps out as obviously wrong.
How to Protect Yourself
The good news: You can avoid this with a few simple habits.
1️⃣ Don’t Click Unexpected Invoices
If you weren’t expecting a bill, don’t open it.
When in doubt:
- Call the company directly (using a number you already know, not the one in the email).
- Log into your account through the company’s official website.
2️⃣ Make Sure You Can See Full File Names
Windows sometimes hides the real file extension.
For example:
You might see:
invoice.pdf
But the real name could be:
invoice.pdf.vhd
That extra “.vhd” means it’s not a PDF at all.
To show file extensions:
On Windows 10:
- Press Windows key + E to open File Explorer.
- Click “View.”
- Check the box for “File name extensions.”
On Windows 11:
- Open File Explorer.
- Click “View.”
- Select “Show.”
- Check “File name extensions.”
This simple setting can prevent a lot of scams.
3️⃣ Use Real-Time Antivirus Protection
Because this malware runs in memory (not as a normal file), basic protection may not catch it.
Malwarebytes recommends using an up-to-date security program that monitors activity in real time—not just file scans.
Bottom Line
If something looks slightly off, pause.
- Were you expecting that invoice?
- Do you recognize the sender?
- Is the file extension exactly what it claims to be?
Cybercriminals are counting on us to click quickly.
Take a breath instead.
