Granted, not a safe habit, but I cheated several times:
I've sometimes just opened the PDFs in question in atril (maybe a bad idea?). So far, they pretty much always did not contain what they claimed, instead containing a button to click to access the promised document...
On some I did click that button, it popped open a login with: Please log into your email: with fields for my email address and password. Aha! If I entered my credentials, they would be able to log into my email account.
Got one of those just the other day. I clicked on it and it displayed what appeared to be my mail provider's login form for that email account. The only difference I could see was the website address in the browser was NOT the mail provider's address. I entered made-up credentials, and clicked login, then it redirected me to my mail provider's front page. That specific mail account has been receiving that form of spam from other users on that domain who apparently provided their real credentials and got their account compromised. Each time a new version shows up I forward it to support@ that provider.
