Hackers Target Users with PDF-Based Callback Phishing Impersonating Microsoft and DocuSign
July 2, 2025
Recent findings from cybersecurity experts highlight an alarming trend in phishing attacks that exploit the trust associated with reputable brands such as Microsoft and DocuSign. These campaigns leverage PDF attachments to manipulate unsuspecting victims into calling phone numbers controlled by malicious actors. Termed Telephone-Oriented Attack Delivery (TOAD) or callback phishing, this technique is gaining traction among cybercriminals as they seek to bypass traditional email security measures.
A comprehensive analysis conducted by Cisco Talos between May 5 and June 5, 2025, revealed that the overwhelming majority of phishing emails featuring PDF payloads are designed to dupe recipients into initiating phone calls to adversary-operated numbers. The report indicates that Microsoft and DocuSign emerged as the most frequently impersonated brands, a testament to their widespread recognition and the trust they command among users. Other notable targets included NortonLifeLock, PayPal, and Geek Squad, further illustrating the deceptive tactics employed in TOAD campaigns.
These phishing emails typically contain cleverly crafted messages and PDF attachments that aim to seem legitimate, thereby exploiting the victims’ familiarity with the brands. The objective is straightforward: to manipulate individuals into divulging sensitive information or following harmful instructions under the guise of recognized institutions.
By leveraging social engineering techniques, such as impersonation of trusted brands, these phishing attacks effectively exploit established consumer trust to initiate malicious activities. The potential repercussions for affected organizations and individuals can be severe, ranging from financial losses to the compromising of sensitive personal data.
From a cybersecurity perspective, this type of campaign underscores the importance of understanding the tactics outlined in the MITRE ATT&CK framework. Adversaries are likely employing multiple tactics for initial access, such as phishing and social engineering, to lure victims into engaging with their malicious infrastructure. Once contact is established, further techniques may include credential dumping or data exfiltration, facilitating ongoing exploitation and persistence within targeted environments.
Protective measures against such attacks necessitate heightened awareness and education among employees about the risks associated with unsolicited communications. Organizations should prioritize training programs that focus on recognizing the signs of phishing attempts and the importance of verifying the authenticity of communication before taking action.
In conclusion, as phishing tactics continue to evolve, so must the strategies employed by businesses to safeguard against these threats. Staying informed about current threat landscapes and understanding the methodologies of cyber attackers is crucial for fostering a resilient cybersecurity posture.
