Attachment: PDF Grant Payment lure with embedded link

calendar Aug 26, 2026  ·
Share on: linkedin copy

Inbound messages carrying a PDF attachment that references a 'Grant Payment Development' RFP or bid solicitation, often sent from compromised or spoofed education-sector (.k12, .esc) accounts. The PDF contains an embedded URL, consistent with a redirect to a credential-harvesting or malicious landing page disguised as bid documentation.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF Grant Payment lure with embedded link"
 2description: "Inbound messages carrying a PDF attachment that references a 'Grant Payment Development' RFP or bid solicitation, often sent from compromised or spoofed education-sector (.k12, .esc) accounts. The PDF contains an embedded URL, consistent with a redirect to a credential-harvesting or malicious landing page disguised as bid documentation."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.),
 9              strings.icontains(.scan.strings.raw, 'Grant Payment Development')
10          )
11          and any(file.explode(.), length(.scan.url.urls) > 0)
12  )  
13attack_types:
14  - "Credential Phishing"
15tactics_and_techniques:
16  - "PDF"
17  - "Social engineering"
18detection_methods:
19  - "File analysis"
20  - "URL analysis"
21  - "Content analysis"
22id: "6cbbc908-5492-5ab5-af4f-6d3aa22205cf"
to-top