Beware of MalDoc in PDF: A new polyglot attack allowing attackers to evade antiV

Researchers have described MalDoc in PDF, a polyglot technique that embeds a malicious Word file inside a PDF so it can evade antivirus detection. JPCERT/CC named the method, which was reportedly used in an in-the-wild attack in July 2023. Yuma Masubuchi and Kota Kino explained that the file keeps PDF magic numbers and structure yet opens in Word, where a configured macro runs a VBS script. Security researcher Will Dormann noted that Protected View blocks the macro until the user clicks "Enable Editing."