Abstract
Clickbait PDFs are PDF documents that do not embed malware but instead trick victims into visiting malicious web pages, leading to attacks like password theft or drive-by downloads. While recent reports indicate a surge of clickbait PDFs, prior works have largely neglected this new threat, viewing PDFs only as accessories of email phishing campaigns. This paper investigates the landscape of clickbait PDFs and presents the first systematic and comprehensive study of this phenomenon. We identify and characterize 44 clickbait PDF clusters using a real-world dataset, focusing on their volumetric, temporal, and visual features. Our findings reveal that clickbait PDFs are a new and prevalent threat, distributed not only as email attachments but also via Search Engine Optimization (SEO) attacks, making them largely undetectable by content-based filtering or detection methods.
The paper in short
Clickbait PDFs don't carry any malware. Page 1 is almost empty except for some bait, usually a fake captcha with a link, and all the other pages are stuffed with links to other similar PDFs. If you click the bait you end up on password theft, scams or drive-by downloads. This paper is the first systematic study of the phenomenon: from a dataset of 176K+ real-world PDFs we mapped 44 campaigns, how they look, how they spread and why almost nothing detects them.
My part: following the rabbit hole
This was my master thesis. I got a pile of these PDFs and one task: follow the link and figure out which campaign is behind it.
Turns out that link hides a long redirection chain with heavy cloaking against bots and Google Safe Browsing, the same tricks malicious ad networks use to protect their revenue (Victor Le Pochat has some great papers on these networks). If the chain decides you are a bot, you never reach the payload.
I spent a couple of months building and refining a crawler that could pass as human: IPs outside the known datacenter ranges, Selenium browsers tweaked to be less detectable, custom algorithms to mimic mouse movement, and real acceptance of web push notifications. At some point the attackers even started serving fake push notification prompts just to filter out automation.
Wait, who even opens these?
While crawling I kept asking myself the same thing: who falls for this? Who opens that from an email?
Then by pure chance I googled some keywords taken from the middle pages of one PDF and found it ranked in Google. That's when it started to click. The link-stuffed pages were backlinks, the keywords were SEO bait, and the campaigns were abusing reputable domains (often through file upload vulnerabilities) to piggyback on their search ranking. These PDFs were never made for your inbox, they were made for search results.
So we started monitoring Google and Bing with the same keywords the campaigns used ("HP printer driver" for specific models, "roblox free robux", ...) and found plenty of evidence that this is an SEO campaign.
That was my part of the paper. The full study (clustering, visual tricks, why VirusTotal barely flags these) is in the PDF (pun intended 😉).