I just opened a PDF attachment then learned that their email had been hacked. I didn't click the link.

[canetoad]

1. First, let your colleague know

That they have a mass mailing worm on their computer. It probably didn't originate from them but from someone that they know and/or exchange emails.

How these worms work in simple terms: Some bastard sends out the first one. It penetrates the recipients computer where it does two main things. First, I goes through the recipients stored email addresses and posts itself out to some or all of them.

Secondly it usually grabs a totally random file or part of a file from the recipients computer and attaches it to the rogue emails from the addresses it has scraped.

It's quite possible that the pdf is totally harmless but it may not be. I'd say you now have the payload of the worm on your computer so you need to get rid of it. A good malware program is needed - Malwarebytes or something else.

A note - it's advisable to run your scan in Safe Mode. You'll need to look up how to access Safe Mode on your device; it varies. Doing this will make sure that the worm is not loaded and able to defend itself when you run the scan - some of them can.

Good luck with all this. I hope it's not already sending out bits of your files to folk in your own address books.