Article summary: Job applications, loan documents, and insurance claims often arrive as PDFs uploaded straight through a business's own website, not as email attachments. A PDF can carry embedded JavaScript, hidden form actions, and buried files that behave very differently from a static page of text. Businesses that only screen inbound email are leaving their client-facing upload forms as an open door.
Your employees know not to open a suspicious email attachment. But what happens when that same malicious file arrives through the upload button on your own website?
Staffing firms accept resumes. Accounting practices collect tax documents. Insurance agencies receive claims. These forms make it easy for clients to send documents without relying on email, but they can also give an attacker another route for getting a file in front of an employee.
If uploaded files are not scanned and secured before they reach your team, a seemingly ordinary PDF can land in a shared folder waiting for someone to open it.
That matters because PDFs can contain much more than text and images. JavaScript, embedded files, links, and interactive actions can all be built into the format. In the wrong hands, those features can turn a routine client upload into a security threat.
The PDF format supports far more than static text and images. PDFs can contain JavaScript, embedded files, links, and interactive forms that submit information to a server. Those features have legitimate uses and are part of what makes PDFs so useful for tax documents, contracts, and applications.
The problem is that attackers can abuse the same features. A malicious PDF might contain a dangerous attachment, direct a user to a phishing site, or use an embedded form to collect sensitive information while still looking like an ordinary business document.
PDFs are already a familiar attack tool. OPSWAT cites 2023 research finding that 76% of email-based malware campaigns used PDF attachments as the initial infection vector.
That familiarity creates a similar risk for client uploads. A resume, tax document, or claim submitted through your own website looks like exactly the kind of file an employee is supposed to open.
Inbound email gets plenty of security attention because it is an obvious attack surface. Contact forms, application portals, and upload widgets can create a similar risk by accepting files directly from people outside the business.
Most website upload fields check the file extension and maybe the file size. Very few inspect what is actually inside the file. A PDF that passes every basic check can still contain a script that becomes a problem the moment staff opens it to review.
An unexpected email attachment may trigger suspicion. A resume submitted through your careers page or a document uploaded through a client portal feels routine because it arrived through a process your business created.
Attackers can exploit that trust by submitting a malicious file through a channel designed to accept documents from outsiders and relying on an employee to treat it like ordinary paperwork.
Some malicious PDFs avoid embedded scripts altogether and instead contain QR codes that lead to phishing sites. Barracuda's 2026 Email Threats Report found that 70% of malicious PDFs in its dataset contained QR codes, often shifting the interaction to a phone where corporate security controls may be weaker.
Blocking PDFs altogether is not practical for businesses that rely on clients to submit documents. The better approach is to screen out potentially malicious files without making the upload process harder for legitimate users.
1. Validate content, not just the extension. A file renamed to end in .pdf is not automatically a PDF. Confirm the actual file structure matches the claimed type before anything downstream trusts it.
2. Strip or disable active content on intake. OWASP's File Upload Cheat Sheet recommends running accepted document types through Content Disarm and Reconstruction, which rebuilds the file without embedded scripts or executable objects.
3. Scan every upload before a human opens it. Route incoming files through anti-malware scanning automatically, rather than relying on the reviewer to notice something is wrong.
4. Store uploads somewhere isolated. Keep client-submitted files out of the same shared drive as sensitive internal data until cleared.
5. Set a size and volume limit. Unusually large files or a burst of submissions from one source are both signals worth a second look.
No technical control catches everything. Employees who review client-submitted PDFs should know the warning signs, including unexpected links or QR codes, unusual pop-ups, embedded attachments, or forms asking for information that does not belong in the submission.
CISA recommends training employees to identify and report suspicious activity and using attachment filters to restrict file types commonly associated with malware. Those same defense-in-depth principles should extend beyond the inbox to files submitted through your website.
If your business collects resumes, applications, claims, or other documents through your website, those uploads deserve the same security attention as files arriving through email.
Vudu Consulting can help you review how uploaded files move through your systems, identify gaps in your current security controls, and put safeguards in place before those files reach your team.
To get started, contact Vudu Consulting or email contact@vuduconsulting.com.
Interactive PDFs can include features such as JavaScript, fillable forms, links, and embedded files. These all have legitimate business uses, but attackers can abuse the same features to hide malicious content or actions inside a document that looks routine.
Potentially. Some PDF actions can be triggered when a document opens, depending on the PDF reader and its security settings. Exploiting a computer generally requires additional malicious behavior or a software vulnerability, which is why keeping PDF readers updated is an important safeguard.
Email phishing often arrives as an unexpected message or attachment. A file submitted through your own website can feel more trustworthy because it arrived through a legitimate business process, making employees less likely to question it before opening it.
