Accidentally opened a phishing PDF in Firefox from a CTF assignment

Soo, I was doing a CTF assignment while being tired and dumb (mostly the second) and accidentally opened a malicious PDF outside of my sandbox, thinking it was a different file. This is the file in question: https://www.virustotal.com/gui/file/f1da326409019d778786142f3d7131423d5114ab71acb72bf6b323fa6b7db5bd

Once it requested the bank credentials, I realized what I had done and closed the file.

I opened it in Firefox (on Windows 11), which doesn't have any saved cookies, bank cards, credentials, etc. I use another browser for all of those, Firefox for testing stuff.

Considering the flags, is there something to worry about? Shall I proceed and re-install my machine just in case? In the embedded JS code, I can see that a call is possibly being made to a reverse shell, but it is supposed to be ran in Linux, but I am using Windows.

Posted May 13, 2026, 6:25 PM UTC

85
Loading comments…