How does a PDF carry malware?

A PDF is more than pages. The format allows several extras, and each one has been misused.

  • Links. The simplest trick, and a common one. The PDF looks like an invoice or a shared file and its button leads to a fake sign-in page. No virus is involved: the page just collects your password.
  • Scripts. A PDF can hold JavaScript, meant for things like adding up a form. In a reader with a security hole, a script can be used to attack the reader itself.
  • Attached files. A PDF can carry other files inside it, as an email does. The PDF is safe to look at, but the attachment may be a program.
  • Reader bugs. Some malicious PDFs contain broken fonts or images built to crash an old reader in a useful way. Updates close these holes, which is why an out-of-date reader is the real weak point.

Can a PDF infect a phone, or infect you just by opening it?

Opening a PDF in a current browser or a current phone is low risk. Phones and browsers keep the viewer in a sandbox, a walled-off area that can’t reach your other files. Attacks that work with no click at all have existed, but they rely on unpatched bugs and are rare.

The realistic danger on a phone is the same as on a computer: a link in the PDF that takes you to a fake page. Installing updates when your phone offers them does more for you than any scanner app.

How do you check a PDF for viruses?

Use two checks, because they answer different questions.

An antivirus answers "is this file known to be bad?". Windows Security and the protection built into macOS scan downloads automatically. Right-click a file in Windows and choose the scan option to check one by hand. Be careful with online multi-scanner sites: files you upload there may be shared with security companies, so don’t send them a private document.

A structure check answers "what is inside this file?". PDF Privacy Scanner lists scripts, automatic actions and attached files without uploading the PDF. Most ordinary documents have none of them, so a one-page "invoice" with a script and an attachment deserves suspicion.

PDF Privacy Scanner is not an antivirus. It shows what a PDF contains and can remove it, but it does not judge whether a script is malicious or compare the file against known threats.

How do you make a PDF safer to open or pass on?

If you need to keep or forward a PDF that has scripts or attachments you don’t need, save a copy without them. In PDF Privacy Scanner, leave Remove scripts and automatic actions and Remove attached files switched on, then press Save a clean copy. The pages look the same, and the extras are gone.

In Adobe Acrobat, two settings reduce the risk for every PDF you open:

  • Turn off JavaScript. Go to Menu, then Preferences, then JavaScript, and clear Enable Acrobat JavaScript. On a Mac, Preferences is under the Acrobat menu. Forms that calculate totals will stop calculating, which most people never notice.
  • Turn on Protected View. Go to Menu, then Preferences, then Security (Enhanced), and choose Files from potentially unsafe locations or All files. Files then open read-only in a sandbox until you choose to trust them.
  • Keep the reader updated. Old versions are what malicious PDFs are built for.

Is it safe to send your own PDFs?

Your PDFs are very unlikely to carry malware, but they often carry more about you than you meant to share: your name as the author, the software you used, comments, and sometimes earlier versions of the text. The same scan shows all of it. Remove PDF Metadata clears the hidden details, and the PDF security tips guide covers passwords and redaction.

If you use online PDF tools, where the file goes matters too. Is an online PDF converter safe? explains how to tell a tool that uploads your file from one that works on your device.