A payment notice lands in your inbox with a PDF attached. It looks routine enough to fit into a busy day of invoices and bank confirmations.
The Notice of Payment document appears to need a quick software update before it will open. That small interruption deserves a closer look.
Overview
A bank name makes the attachment feel routine
The Notice of Payment campaign impersonates Absa, a real banking group. The email claims to contain official payment information and includes an attachment named Absa.pdf.
Its wording discusses the software needed to read PDF documents. That detail prepares the recipient for an update request before the document is even opened.
Absa is not the sender of the deceptive message. The bank’s name is a credibility cue borrowed by the attacker.
The message should be assessed as an unsolicited payment document, not as proof that money arrived or a legitimate bank contacted you.
The PDF is a bridge to a script
The attachment does not rely on a hidden PDF exploit in the reported chain. It displays an alleged Acrobat Reader problem and asks the reader to update the software.
The update button downloads a Windows VBScript file named PDF_Update_Installation.vbs. A .vbs file is executable script content, not an ordinary PDF reader update.
The serious infection risk begins when that downloaded script is run. Opening the email, opening the PDF, downloading the script, and executing it are different exposure levels.
The exact malware delivered by the script was not identified in the observed report. It would be inaccurate to name a particular trojan as a confirmed payload.
The quick warning signs
- A payment message arrives without a matching transaction or business relationship.
- The PDF says software must be installed before its supposed contents can be read.
- An attachment sends you to a separate download instead of displaying payment details.
- The downloaded file ends in .vbs rather than being a legitimate application update.
- The email supplies its own explanation for why the document will not open.
Any one detail can be explained away during a rushed workday. Together they reveal a path from a payment pretext to code execution.
The screenshots here are nonfunctional illustrations of the email and update prompt. They do not reproduce a live malicious document or executable file.
Why This Payment Notice Is Not Just Another Invoice Scam
Many fake invoices aim to steal a password on a counterfeit document portal. This campaign has a different goal: persuade the recipient to run a downloaded Windows script.
That distinction changes the response. A password reset alone may be insufficient if code actually ran on the computer.
The first lure is familiar to accounts staff. Payment advice can arrive from clients, suppliers, banks, and payroll systems, often as PDFs.
A busy recipient may open the attachment to match it against a ledger entry. The bank’s name makes the message feel more formal than an unknown sender would.
The second lure turns a failure into a repair task. Instead of showing payment details, the PDF suggests your software is too old.
Software updates are usually positive safety actions. Here that sensible habit is redirected toward a file chosen by the attacker.
The PDF’s visible message is part of the attack. Do not confuse a document’s statement about Acrobat with an authentic update check performed by Acrobat itself.
If your PDF reader opens other documents normally, a single unsolicited attachment demanding a special update deserves even more skepticism.
Even when the reader genuinely needs updating, the correct route is the software’s built-in updater or the vendor’s official site reached independently.
How the Notice of Payment Malware Email Works
Step 1: The email presents an ordinary finance task
The subject says a payment notice is attached. The body uses official-sounding language and claims the document is intended for the named recipient.
The attacker does not need to prove a real transfer occurred. The possibility of one is enough to encourage opening the file.
A business may receive dozens of genuine PDFs. That volume makes this kind of lure more plausible than an obviously unrelated prize message.
Step 2: The attachment postpones the promised information
Rather than supplying usable payment details, Absa.pdf shows a message about an outdated reader. The document creates a problem the attacker can supposedly solve.
This is a social-engineering maneuver. The PDF is not automatically proof of infection, but its update button is not trustworthy merely because it appears inside a document.
A legitimate bank would not require you to install a Windows script as the price of reading a payment advice.
Step 3: The update button downloads a VBScript file
The reported filename is PDF_Update_Installation.vbs. Windows treats this format as script code that can perform actions when executed.
The file may be hidden behind a friendly update label in the interface. The extension and download source matter more than the label.
Do not rename the file, double-click it, or test it to see whether it works. Preserve it only if an incident-response team asks for a sample.
Step 4: Running the script opens the infection path
The downloaded script is designed to inject malware onto the device. The observed analysis did not establish a specific final malware family.
That uncertainty is not reassuring. A script can act as a downloader, execute commands, or prepare the system for additional payloads.
The exact effect depends on what the script did in that environment and whether security tools blocked it. Respond to evidence, not to a guessed malware name.
Step 5: The attacker can exploit a business foothold
If malicious code gains access, the risk may extend beyond one PDF. A finance workstation can hold email sessions, invoices, banking bookmarks, and supplier records.
Those materials can support later account takeover or payment redirection. This is a possible downstream consequence, not a documented outcome for every recipient.
That is why organizations should examine endpoint and account activity after execution rather than simply deleting the attachment and moving on.
Sender, Transaction, Document, and Software Checks
Confirm the sender outside the message
Read the full sender address and reply-to field. Display names are easy to forge, and even a familiar address can be compromised.
If the message concerns an existing relationship, contact the payer using a number already in your records. Do not use the email’s signature to verify itself.
Match the alleged payment to your records
Check your actual bank account or accounting system for a corresponding transaction. An attachment is not a deposit confirmation.
If the amount, reference, beneficiary, or date is absent from the message, resist the urge to open a file just to discover what it means.
Inspect the document’s behavior
A PDF that immediately asks for software installation is no longer simply providing information. Close it and investigate before following its instructions.
Warning banners, links, and buttons inside documents are untrusted content. They should not be granted the authority of the PDF viewer.
Update software from its own channel
Use the reader’s update feature, your organization’s software center, or the developer’s site reached independently. Never run a script offered by a payment attachment.
IT teams can check file type, origin, and endpoint telemetry without relying on the document’s explanation. A filename containing “update” does not establish publisher identity.
What to Do if You Opened the Email or Ran the Script
- If you only received the email, do not open the attachment. Mark it as phishing or report it to your security team. You do not need to assume your device is infected simply because it arrived.
- If you opened the PDF but did not click or run anything, close it. Delete the downloaded copy after preserving the email for reporting. Check your downloads folder for anything the button may have fetched.
- If you downloaded the VBS file but did not run it, do not test it. Ask IT to inspect the file if this is a work device. A reputable security scan can help confirm that no other action occurred.
- If you executed the script, disconnect the device. Turn off network access to limit further downloads or communication. Tell your employer’s security team immediately if business data was available.
- Scan and investigate the endpoint. Run Windows Security and Malwarebytes, and review detections with a professional if needed. A clean scan is helpful, but it does not replace checking logs and persistence on a business machine.
- Change sensitive passwords from another clean device. Prioritize email, banking, payroll, and accounting accounts used on the affected system. Revoke sessions and review multifactor settings.
- Check for financial follow-on activity. Compare recent transfers and supplier bank details against independent records. Contact your bank promptly if anything changed without authorization.
- Warn other recipients. Search the mail system for the same subject and attachment, then block the sender or malicious destination. AdGuard may reduce exposure to malicious pages, but it cannot make a received attachment safe.
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. A quick way to check is to scan your device with Malwarebytes Free, one of the most trusted malware removal tools available. If you only visited a scam page and didn’t download or install anything, this scan is optional.
The free version detects and removes the most common threats, including:
- Adware — the cause of those annoying pop-ups
- Browser hijackers — unwanted redirects and changed homepages
- Trojans and spyware — hidden programs stealing your data
- Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan your PC and remove what Malwarebytes finds.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium
Malwarebytes Free for WindowsScans and removes malware at no cost-
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
-
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
-
Malwarebytes will now install on your device. This usually takes under a minute.
-
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
-
On the final screen, click Open Malwarebytes to launch the program.
-
Optional: Check for rootkits with a Custom Scan
You don’t need to change any settings for a normal scan. The standard Threat Scan in the next step is enough for most problems, so you can go straight to it.
If you also want to check for rootkits, use a Custom Scan. In current versions of Malwarebytes, rootkit scanning is only available there:
- On the Scanner tile, click the three-dot menu and select Advanced Scan.
- Choose Custom Scan. In its options, check Scan for rootkits.
- Select your system drive (usually C:\) as the location to scan, then start the scan. It takes longer than a Threat Scan.
- When it finishes, review and quarantine the results as described in the steps below.
Rootkit scanning isn’t available on Windows devices with ARM processors.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
-
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
-
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.
When the scan is done, check whether the problems you noticed have stopped. If they continue, see the options below.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
- Run a computer scan with ESET Online Scanner
- Ask for help in our Windows Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Mac
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan your Mac and remove what Malwarebytes finds.
-
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
Download MalwarebytesOfficial installer for macOS. Your download starts right away.Want real-time protection? See Malwarebytes PremiumMalwarebytes Free for MacScans and removes malware at no cost -
Open the Malwarebytes setup file
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
-
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
Malwarebytes needs Full Disk Access to check your whole Mac. When it asks, open System Settings > Privacy & Security > Full Disk Access, turn on Malwarebytes (it may be listed as Malwarebytes Protection), and confirm with your password or Touch ID. Then return to Malwarebytes. On macOS Monterey and earlier, this setting is in System Preferences > Security & Privacy > Privacy.
-
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
-
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
-
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
-
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, check whether the problems you noticed have stopped. If they come back, save the scan report and ask for help in our forum.
If the problems you noticed continue after the scan, see the options below.
If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android scans your phone or tablet for malware, adware, and potentially unwanted apps. The free version scans only when you start a scan. Real-time protection, which checks apps automatically, is part of the paid Premium version.
-
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for AndroidMalwarebytes for AndroidScans your phone and removes malware at no cost -
Install Malwarebytes for Android on your phone.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
-
Follow the on-screen prompts to complete the setup process
When Malwarebytes opens, it walks you through a short setup. Tap Get started and follow the prompts. If you see an offer for a trial or a paid plan, read it before you accept. You can skip it and keep using the free scanner.
Malwarebytes will ask for permission to access the files on your phone so it can scan them. Tap Allow, or turn on the permission in the Android screen that opens, then return to Malwarebytes.
-
Run a scan with Malwarebytes for Android
On the main screen, tap Scan now. In some versions, you open the menu, tap Scanner, and then tap Run a scan.
-
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
-
Remove the detected apps.
When the scan has been completed, you will see a list of the threats that Malwarebytes for Android has detected. Next to each detected item, tap the menu icon (three dots), then choose to uninstall the app or delete the file. Android then asks you to confirm. Tap OK or Uninstall to remove the app.
-
Restart your phone.
When the detected apps are removed, restart your phone if Malwarebytes asks you to. Then check whether the problems you noticed have stopped.
If the problems you noticed continue after the scan, see the options below.
If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
- Ask for help in our Mobile Malware Removal Help & Support forum.
- Only as a last resort, reset your phone to factory settings. Read the warning below first.
- Back up your photos, videos, files, and messages, for example to your Google account or a computer.
- Make sure you know your Google account email and password. The phone asks for them after the reset. If you changed the password recently, Google recommends waiting 24 hours before you reset.
- On a Samsung phone, also make sure you know your Samsung account password.
- If you use an authenticator app for two-step verification, move your accounts to another device or save your backup codes first.
Stay Protected: Block Ads and Malicious Sites
No scan can prove a device is completely clean, so it helps to block threats before they reach you. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
👉 Download AdGuard and browse safely
Why the Unknown Final Payload Still Matters
Security writing often gives malware a precise family name. Here the reported chain identified the malicious script but did not establish the final payload.
That limitation should change the investigation, not delay it. A script may download a different program later, or fail on one machine while succeeding on another.
The absence of a visible ransomware screen is not proof of safety. Data-stealing tools and remote-access software can run without obvious windows.
Likewise, a browser that still works normally does not show whether a credential was copied or a scheduled task was created.
Look at the timeline: when the script ran, what child processes started, what files appeared, and which addresses the machine contacted.
Home users may not have detailed logs. They can still preserve the file, run reputable scans, review recent installations, and change important passwords from a clean device.
Businesses should involve endpoint and mail administrators. One recipient can be an entry point into accounts and systems beyond the affected workstation.
A clean antivirus scan is useful evidence, but not a guarantee that no action occurred. An expert can decide whether a rebuild is warranted.
If no script was executed, avoid inventing an infection. Classifying exposure correctly prevents unnecessary panic and focuses effort where it helps.
What a Finance Team Should Do With the Payment Claim
Do not let the attachment become the only evidence of a supposed transfer. Payment notices can arrive before settlement, and forged notices can claim transactions that never happened.
Check the actual bank portal and accounting ledger. Match the amount, payer, reference, and date before marking an invoice as paid.
If the sender resembles a known customer, call a contact number already saved in your records. An address or number printed in the new message cannot verify itself.
Keep a simple escalation path for unusual payment PDFs. Staff should be able to ask for help without losing time or being blamed for a cautious question.
Where possible, use a separate document sandbox or approved viewer for unexpected attachments. A user should not have to make a high-risk installation decision mid-reconciliation.
Security teams can search for the same subject, attachment name, or sender across mailboxes. That shows whether the message targeted one person or a wider group.
Block the distribution route after preserving a sample. Then tell employees what the deceptive PDF asks for, not merely that an email was “suspicious.”
Specific warnings are more useful: the reader prompt downloads PDF_Update_Installation.vbs, and that file must not be run.
If a payment was genuinely expected, ask the payer to resend details through the normal secure channel. An attacker should not dictate how legitimate work resumes.
Document the verification result in the invoice record. The next colleague should see whether a transfer was confirmed, rejected, or still pending.
That small note can prevent the forged PDF from being rediscovered and treated as fresh evidence during a later shift.
Frequently Asked Questions
Is the Notice of Payment email really from Absa?
The examined campaign impersonates Absa. Verify any real banking notice through your own bank account or the bank’s official contact channels.
Does opening Absa.pdf infect the computer?
The reported chain uses the PDF to persuade the reader to download and run a script. Opening it is not the same exposure as executing PDF_Update_Installation.vbs.
What is a .vbs file?
It is a Windows script file. Unlike a passive payment document, it can execute instructions when run.
Do we know which malware the script installs?
No confirmed final family was identified in the observed analysis. Treat execution as a serious incident without inventing a specific payload.
Should I update Acrobat to open this attachment?
Not through the attachment’s button. If your reader needs an update, use its official updater or your organization’s managed software channel.
Should a business keep the suspicious email?
Yes, if an incident occurred. Preserve headers, attachment, and timestamps for IT, while avoiding further execution. Otherwise report and remove it according to company policy.
The Bottom Line
This message uses a bank-branded payment PDF to turn a document review into a fake Acrobat update. The dangerous step is running the downloaded VBScript.
Verify the payment through your own records, update software only through trusted channels, and respond quickly if the script ran.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.