Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

calendar Sep 2, 2026  ·
Share on: linkedin copy

Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link"
 2description: "Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments,
 8                 .file_type == "pdf"
 9                 // creator and producer of PDF seen in malicious content
10                 and (
11                   strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
12                   or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
13                 )
14          ),
15          any(filter(file.explode(.), .scan.ocr.raw is not null),
16              (
17                any(ml.nlu_classifier(.scan.ocr.raw).intents,
18                    .name in ('cred_theft', 'bec') and .confidence != 'low'
19                )
20              )
21          )
22          // suspicious link
23          and any(file.explode(.),
24                  any(.scan.pdf.urls,
25                      // short 1 char path
26                      length(.path) == 2
27                      // oauth redirect
28                      or (
29                        strings.istarts_with(.path, '/oauth/')
30                        and strings.icontains(.query_params, 'redirect_uri=')
31                      )
32                      // short 1 char path in redirect
33                      or any(.query_params_decoded['redirect'],
34                             length(strings.parse_url(.).path) == 2
35                      )
36                      // url param conatins recipeint domain
37                      or any(.query_params_decoded['url'],
38                             strings.contains(strings.parse_url(.).path,
39                                              recipients.to[0].email.domain.sld
40                             )
41                      )
42                      // multiple redirectUrl query_parms
43                      or length(.query_params_decoded['redirectUrl']) > 1
44                  )
45          )
46  )  
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "PDF"
51  - "Open redirect"
52  - "Social engineering"
53detection_methods:
54  - "Exif analysis"
55  - "Optical Character Recognition"
56  - "Natural Language Understanding"
57  - "URL analysis"
58  - "File analysis"
59id: "63977bda-8d15-543a-8308-6c2ba7884402"
to-top