Phishing attacks are getting sneakier, and one of the most deceptive trends making headlines is PDF-based callback phishing, or “TOAD” (Telephone-Oriented Attack Delivery). Attackers are distributing PDF files that look like official documents from brands like Microsoft, Norton, or PayPal. These files contain QR codes or phone numbers and instruct recipients to call for urgent account or billing issues. When the victim calls, they’re tricked into handing over sensitive information or installing malware—often believing they’re speaking to legitimate tech support.

Unlike traditional phishing, this method bypasses email links altogether, preying on human psychology and urgency. The PDFs may contain real branding and professionally written language, making them look trustworthy. Once on the call, victims may be led to download fake “security tools” or reveal credentials under the guise of identity verification. These attacks combine social engineering with a sense of urgency and credibility that makes them alarmingly effective.

Organizations must urgently educate employees on this phishing variant. No reputable company will ask you to call a phone number via a PDF attachment. Train staff to report suspicious documents, block PDF attachments from unknown sources, and verify contact info through official websites. Security teams should implement anti-phishing tools that scan attachments and apply content inspection on incoming email traffic.