Due to the popularity of the portable document format (PDF), malware writers continue to use it to deliver malware via web downloads, email attachments and other infection vectors in both targeted and non-targeted attacks. It is known that PDF attackers can break detection by using polymorphic techniques to hide malicious code, randomizing JavaScript, obfuscating embedded shellcode or using cascading filters. Malware writers have always tried hard to develop new techniques to bypass detection. Some recent PDF attack campaigns we have seen are typical examples of such new endeavors from malware writers: a) Simple but effective URL aliasing technique to download malware. b) Using PDF to deliver specific topic related text content for search engine poisoning. c) Encapsulating PDF malware inside a PDF file to break detection. In this paper we will investigate the recent PDF malware campaigns using - and often abusing - these new techniques.