Malicious PDF Credential Phishing Page

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.