The team behind the SolarMarker malware have been loading it into PDFs and using web search to trick people into downloading them (via ZDNet).
SolarMarker Malware
Microsoft says that SolarMarker/Jupyter is a backdoor that can steal login credentials and other data from browsers. The team is using a technique called “SEO poisoning” as a way to get their web result as high as possible in search results like Google. “In this case, the attackers are using thousands of PDFs filled with keywords and links that redirect the unwary across multiple sites towards one that installs the malware.”
Read more at MacObserver.com