Researchers at HP Wolf Security released a report on May 20, 2022, regarding a new malware distribution campaign utilizing malicious PDFs to deliver the “Snake Keylogger” malware. A PDF document is not a common malware delivery method, as malicious emails typically involve Word “.docx” or “.xls” attachments that are laced with malicious macros, and this shift demonstrates threat actors’ evolving tactics to combat users becoming more educated. The observed campaign involved a PDF document titled “REMMITANCE INVOICE.pdf” that, once opened by the researchers in Adobe Reader, prompted the victim to open an embedded “.docx” file. This Word document is interestingly titled “has been verified. However PDF, Jpeg, xlsx, .docx”. This naming convention was done in order to make the file name blend into the prompt’s text and appear non-suspicious. Once the victim opened the file and protected view was disabled, Word downloaded a Rich Text File (“.rtf”) titled “f_document_shp.doc” from a remote web server. The file contained malformed object linking and embedding (OLE) objects in order to bypass analysis and eventually attempted to exploit a past remote code execution (RCE) vulnerability in Microsoft Equation Editor, which is tracked as CVE-2017-11882. The researchers emphasized that the exploit shellcode was encrypted, which is an example of the threat actor attempting to bypass detection. Snake Keylogger, known information-stealing malware identified as “fresh.exe,” is then downloaded. Analysts noted this campaign is interesting due to it utilization of three (3) methods to stay under the radar (“embedding files, loading remotely-hosted exploits and encrypting shellcode”), its unusual use of PDF, and its use of a four (4) year-old vulnerability that appears to still be effective. CTIX analysts will continue to release updates on malware distribution campaigns’ evolving intrusion methods.