Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

calendar Oct 1, 2026  ·
Share on: linkedin copy

Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link"
 2description: "Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments,
 8                 .file_type == "pdf"
 9                 // creator and producer of PDF seen in malicious content
10                 and (
11                   strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
12                   or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
13                 )
14          ),
15          (
16            any(filter(file.explode(.), .scan.ocr.raw is not null),
17                (
18                  any(ml.nlu_classifier(.scan.ocr.raw).intents,
19                      .name in ('cred_theft', 'bec') and .confidence != 'low'
20                  )
21                )
22            )
23            or any(ml.logo_detect(.).brands, .name == 'Microsoft')
24          )
25          // suspicious link
26          and (
27            any(file.explode(.),
28                any(.scan.pdf.urls,
29                    // short 1 char path
30                    length(.path) == 2
31                    // oauth redirect
32                    or (
33                      strings.istarts_with(.path, '/oauth/')
34                      and strings.icontains(.query_params, 'redirect_uri=')
35                    )
36                    // short 1 char path in redirect
37                    or any(.query_params_decoded['redirect'],
38                           length(strings.parse_url(.).path) == 2
39                    )
40                    // url param conatins recipeint domain
41                    or any(.query_params_decoded['url'],
42                           strings.contains(strings.parse_url(.).path,
43                                            recipients.to[0].email.domain.sld
44                           )
45                    )
46                    // multiple redirectUrl query_parms
47                    or length(.query_params_decoded['redirectUrl']) > 1
48                )
49            )
50            // sendgrid link, only on single-page PDFs
51            or (
52              beta.parse_exif(.).page_count == 1
53              and any(file.explode(.),
54                      any(.scan.pdf.urls,
55                          strings.iends_with(.domain.domain, 'ct.sendgrid.net')
56                          and .path == '/ls/click'
57                      )
58              )
59            )
60          )
61  )  
62attack_types:
63  - "Credential Phishing"
64tactics_and_techniques:
65  - "PDF"
66  - "Open redirect"
67  - "Social engineering"
68detection_methods:
69  - "Exif analysis"
70  - "Optical Character Recognition"
71  - "Natural Language Understanding"
72  - "URL analysis"
73  - "File analysis"
74id: "63977bda-8d15-543a-8308-6c2ba7884402"
to-top