A user clicked the wrong link and visited a shady website, they downloaded a PDF and opened it and suddenly their system seems sluggish. So they turn to the Internet for help. A Samaritan, who works in IT, might say variants of the following:
“Browsers are secure, you cannot get infected by visiting a website.”
“It would need a zero-day exploit to infect you and those are extremely rare and costly and only used in targeted attacks.”
“PDFs cannot be malware. You need to download and run an EXE file to infect yourself.”
I have multiple problems with this advice; and it’s not just because I am pedantic, which I am. I believe generalized sentences like these are harmful for long-term malware prevention efforts. But let’s first start at why these statements are wrong and once I convinced neurotypicals that I am indeed pedantic, we can talk about the harm that they cause.
Sentence 1: “Browsers are secure, you cannot get infected by visiting a website” (sic!)
Browsers have indeed been comparably secure since the era of drive-by-downloads via Java applets is over. But nowadays an increasing number of people use AI extensions that read input from arbitrary websites they visit and are vulnerable to prompt injection. Merely visiting the wrong site can lead your AI extension to exfiltrate data or run malicious commands. While this isn’t a problem in the browser itself, the idea that a system “cannot get infected by visiting a website” is not true.
Browser exploits are another possibilitiy how website visits can be damaging to the system, which leads us to the next sentence.
Sentence 2: “It would need a zero-day exploit to infect you and those are extremely rare and costly and only used in targeted attacks” (sic!)
Why is there such a focus on zero-day exploits? Targeted attacks do not need a zero-day, in fact, a 4-day exploit or a 4-months or sometimes even 4-year exploit will do just fine. Zero-day refers to exploits that are, so far, unknown to the public. But old exploits work too, and are used more often, because they are known, often have proof-of-concept code on Github or can be automatically generated with exploitation frameworks. There are plenty of systems with outdated software and when talking to a stranger on the Internet who seeks advice because of a potential infection, the chance is there that they have some outdated software on their system.
Exploits are not rare. Not only do I see them almost every other day at my job, but the mere numbers should convince you: According to ZeroThreat 48,185 CVEs were published in 2025, with an average of 133 per day.
A lot of people seem to believe that exploits are only targeted and never opportunistic, probably because they also believe exploits require lots of resources, either in time or money, thus, will not be wasted for just anyone. But this is wrong. Look at WannaCry, which used the publicly know EternalBlue exploit to mass-infect systems all over the world. And whenever there is an easy-to-use publicly known exploit, you can be almost certain that some criminals will attack opportunistically. There is no reason to believe these exploits will never affect browsers, common browser extensions, or common PDF viewers. This year Google patched at least three actively exploited Chrome vulnerabilities, which allowed remote-code-execution: CVE-2026-2441, CVE-2026-3910, CVE-2026- 5281.
“Only used in targeted attacks” seems to assume that most people can’t become targets. The targeted attack argument pops up often, not only with exploits, but also with bootkits or anything that is currently not part of the mainstream malware landscape. There seems to be the idea that targeted attacks are only done to famous people, politicians or CEOs of big companies. But everyone can become a target. Of course it’s unrealistic that someone buys a zero-day for thousands of dollars just to get your personal Steam account. But if your job involves using any computers, you might become a target just to get an entry point to the company network.
Sentence 3: “PDFs cannot be malware. You need to download and run an EXE file to infect yourself” (sic!)
The user in this fictious scenario describes that they downloaded a PDF. Since John Hammond claimed in a video with ~130K views that PDFs are generally safe to open, his viewers spread the generalized sentence "PDFs cannot be malware" further, but without Hammond's nuanced explanations and the rather unusual malware definition in the video. To be clear: PDF files can absolutely be malware, they are just not prevalent today.
It is somewhat unclear what downloading and running an “EXE” file exactly means. A lot of people will interpret this sentence as a file with “.exe” extension and that does not cover every file that can contain malicious code. However, the person saying it most likely means everything that is “executable”. But the general population does not know what is executable and what isn’t and have their own ideas about it. E.g., people may not know which document types can contain executable code. To make things worse, non-executable files can absolutely be an infection vector too (external templates in office documents or OneNote documents for example).
So what happens if the helper asks whether the worried user ran an “EXE”. The user will most likely respond with “No” even after they downloaded and double-clicked an LNK with PDF icon that ran malware and a decoy PDF via Powershell. In their mind they only opened a PDF, which many people on the Internet, including professional security researchers, already deemed safe.
Frequent landscape changes
Since I started working in this field 11 years ago and because I have been interested in the history of malware, how they changed over time and why they evolved the way they did, I witnessed frequent sudden changes in the malware landscape, where in the course of 1 or 2 years certain malware types almost went extinct, or new infection vectors popped-up and in just a few months dominated the landscape.
To name some examples: Around 2015 Flash malware and Java drive-by-downloads were still prevalent and soon went extinct as browsers did not allow these technologies anymore. File encrypting ransomware had just begun to emerge and became a very prevalent malware type. Screenlocker ransomware on the other hand became almost irrelevant at the same time because file encryption was (and is) much more lucrative for criminals.
More recent changes are the switch from common malware loader families to the abuse of legitimate remote access software for initial infection. The main reason is the takedown of loader families by the law enforcement in Operation Endgame, which started in May 2024 and had their latest operations in June 2026. Late 2022 started a massive surge of malware delivered via OneNote documents and has pretty much stopped by now. Nowadays we see users copy, paste and execute malicious commands themselves because they believe they are solving a Captcha (ClickFix attacks).
Inaccurate generalizations are harmful for malware prevention
Generalized sentences like “PDFs are never malicious” or “visiting websites does not infect the system” were put into people’s heads repeatedly over years and used to train large language models. But with these sudden threat-landscape changes, they become the main driver for using them as infection vectors. They are very effective after users have been “trained” to ignore safety precautions that would prevent them.
So instead of telling everyone that certain actions are always safe, demanding a general caution against visiting any website or downloading any files from the Internet would be much better. But that requires nuance when responding to help requests, which is often not something internet users care about.
I get it, the user you are responding to only wants to hear they are safe, they don’t want nuance in that moment of despair. Telling the user “visiting a website doesn’t infect you” is a working shortcut for the moment, but the long-term effect on anyone reading this is indeed harmful.
Whilst it is unrealistic of me to think I can convince the general Reddit user, I hope I can appeal to my fellow researchers and analysts to refrain from generalization to “speed things up”. After all you are the ones, who people (should) trust the most with security advice.
