"The e-mails sent in bulk looked like credit card statements, and contained an attachment called 'report.pdf'," its Chief Research Officer Mikko Hypponen said in a statement.

When such PDF files are viewed on vulnerable machines, they start downloading software from servers in Malaysia or Sweden, which are now being cleaned, he said. "There will be more such attacks."

"We are worried about this case, as PDF attachments are typically not filtered at e-mail gateways."

A security update for Adobe Acrobat Reader, which opens PDF files, was made available a few days ago, but many users have not updated the program yet, Hypponen said.