Full phishing URL embedded in PDF JavaScript; launches when victim clicks 'Atualizar' button or JavaScript auto-redirects