I’ve written before about PDFs with URLs used in social engineering attacks (TL;DR: nowadays, it’s more likely you’ll receive a malicious PDF that just contains a malicious URL, than a PDF with malicious code).
Article Link: https://isc.sans.edu/diary/rss/23167