LegionLoader PDF Lure: Email Client → PDF Reader Spawning Browser

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•3

This rule detects potential credential harvesting or malware delivery by identifying an email client (e.g., Outlook) launching a PDF reader, which subsequently executes a web browser. This sequence is a common indicator of a user interacting with a malicious link or 'Sign' button inside a PDF attachment opened directly from an email.