BASALT · JOURNAL
Can a PDF have a virus on a Mac? What's risky and how to check
Yes, a PDF can carry a virus or something like one on a Mac, but not because the file is a program that runs by itself. A malicious PDF does damage in one of three ways: it exploits a flaw in the software that reads it, it contains active content such as JavaScript or an action that launches something, or, most often, it simply links to a fake page that asks for your password.
On a Mac the third case is the one you're most likely to meet, so a PDF with a virus is less common than a PDF with a bad link. No file check will catch it, because a link is just text. The first case is rare and gets fixed by updates. The second is easy to look for, and that's what the commands below do without opening the file.
The three ways a PDF can hurt you
The first route is a flaw in the code that parses PDFs. Apple's own security notes show this is real. In the notes for Security Update 2021-005 Catalina, the CoreGraphics entry for CVE-2021-30860 reads "Processing a maliciously crafted PDF may lead to arbitrary code execution," and Apple adds that it was aware of a report that the issue may have been actively exploited. That update fixed it. The lesson isn't that PDFs are unsafe, it's that the reader has to be current.
The second route is active content. A PDF can hold /JavaScript actions, an /OpenAction that runs when the file opens, /AA entries that fire on events, a /Launch action that asks the reader to open another file or program, /SubmitForm actions that send form data to a web address, and embedded files stored inside the document. Whether any of these does anything depends on the reader. Many readers limit or ignore them, and some readers ask before they act. Their presence is a reason to look closer, not proof of an attack.
The third route needs no technical trick. A PDF invoice, a "shared document" or a fax notice can contain a link or a QR code that opens a login page built to copy your password. The file passes every structural check because it contains nothing but a normal web address. Check where a link goes before you click, and open the site by typing its address yourself if the message was unexpected.
Look inside before you open it
You can inspect a file without opening it in any viewer. First make an uncompressed copy with qpdf (brew install qpdf, from brew.sh). The expanded copy is a new file, and the original isn't touched.
qpdf --qdf --object-streams=disable document.pdf expanded.pdfExpansion matters because since PDF 1.5 many dictionaries sit inside compressed object streams, where a plain search can't see them. Now count the risky keys in the expanded copy. Use grep -a, because without -a the macOS grep treats a PDF as binary and prints nothing useful.
grep -a -o -E '/(JavaScript|JS|OpenAction|AA|Launch|URI|SubmitForm|GoToR|EmbeddedFile)\b' expanded.pdf | sort | uniq -cOn a test file with a script that runs on opening and a single link, this printed one each of /JavaScript, /JS and /OpenAction, and two /URI. Each key is counted where it appears, so one script shows as both /JavaScript and /JS, and one web link counts twice, once as the action type and once as the address. A file with none of those keys prints nothing. A count above zero tells you where to look, since /URI is on every ordinary link and /EmbeddedFile can be a harmless attached spreadsheet. A count of zero for the active keys is reassuring but not a verdict.
To see where the links go, print the addresses:
grep -a -o '/URI *([^)]*)' expanded.pdfRead each address as you would a link in an email: does the domain match the sender, and does it look like a lookalike? Remember that the text a reader shows for a link can differ from the address underneath. Can a PDF track you goes into what links and forms can send back.
What the built-in tools tell you
Preview's Inspector (Tools > Show Inspector) has an Annotations pane that lists annotations by type, author, date and page. It's useful for comments, but it isn't a list of a file's actions, so it won't tell you about JavaScript or an open action.
Spotlight can show what the file claims to be. This command reads a file without indexing it:
mdimport -t -d2 document.pdfIt prints the page count, producer and security method, and nothing about actions or scripts, so don't treat a clean Spotlight result as a safety check.
What no check can promise
A structural check looks at the file's dictionaries. An exploit for a parser flaw doesn't need any of the keys above. It can sit inside a malformed font, an image or a compressed stream that looks ordinary until the reader tries to decode it. So a clean grep proves the file has no obvious active content, nothing more.
What reduces the real risk is simple. Keep macOS updated, since Apple ships fixes for its PDF code through system updates. Don't enter passwords on pages you reached from a PDF. Treat an unexpected attachment from a stranger the way you'd treat any unexpected attachment. For a file you can't verify, don't enable anything a reader offers to run. Neither Gatekeeper nor any other macOS check is documented to scan PDFs for malware, so don't count on one.
If a file is worth being careful with, inspecting a PDF's contents shows the other things it carries, and what JavaScript in a PDF can do covers the scripting case in more detail.
Frequently asked questions
Can a PDF have a virus?
Yes, in limited ways. A PDF can exploit a flaw in the reader that opens it, carry scripts or launch actions, hold embedded files, or link to a phishing page. It isn't an executable and can't run on its own, but a flawed or permissive reader can be tricked into running something. Updates close the flaws, and caution with links covers the rest.
Is it safe to open a PDF from an unknown email?
It's lower risk than opening an unknown program, but not risk free. Opening a PDF in Preview with macOS up to date is reasonably safe, because the main danger is a link you might click afterward. Don't click links, scan QR codes or enter passwords from an unexpected message, and check the sender through another channel if the document seems important.
How do I scan a PDF for malware on a Mac?
No built-in Mac tool is documented to scan PDFs for malware. You can look inside the file without opening it by expanding it with qpdf and searching for keys such as /JavaScript, /OpenAction, /Launch and /EmbeddedFile, as shown above. That finds active content, not every exploit, so treat a clean result as a good sign and not a guarantee.
How do I check a PDF for malware without opening it?
Expand it with qpdf --qdf --object-streams=disable, then search the copy with grep -a for the active-content keys and list the /URI addresses. Neither step opens the file in a viewer. If you find JavaScript, a launch action or an attachment you didn't expect, ask the sender before opening it.
Can Preview get a virus from a PDF?
It's possible in principle, since any program that parses files can have a flaw, and Apple has patched PDF-handling flaws before. The CVE-2021-30860 note covers the system's CoreGraphics code. In practice, keeping macOS updated is the main protection. Don't treat any one app as immune.
Can a PDF steal my passwords?
Not by itself, but a link inside it can send you to a page that does. Phishing PDFs imitate invoices, shared documents and account notices, and the page they point to asks you to sign in. The defense is to check the address before you click and to open the real site yourself if you aren't sure.
Does a clean result mean the PDF is safe?
No. A clean structural check means the file shows no obvious active content, which is useful, but an exploit can hide in a font, an image or compressed data. The check also can't tell whether a link goes somewhere bad. Combine it with an updated Mac and a sender you've confirmed.
Doing it in Basalt
Basalt isn't antivirus and doesn't scan for malware, so it can't tell you a file is safe. What it does is report what a PDF carries in a plain-English list with a severity for each item: whether it has JavaScript, embedded files, optional layers, annotations and more, without quoting the contents. Clean Up can remove embedded files you choose and optional layers, and saves a cleaned copy, never touching the original. It doesn't open or extract attachments. Documents are opened by a separate engine process with no network entitlement, so the process reading a suspicious file can't connect anywhere. Basalt costs $29 once for up to three Macs, and every tool is free to try for 24 hours.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
