an attacker manipulated the IBAN of an invoice.pdf attached to a received email. The question remains, can said attacker manipulate/change such a pdf client-side and cause an IMAP synchronization with the webmailer provided by a hoster?
I couldn't find a solution to this attack scenario, maybe you guys can provide a hint.
best
If somebody has IMAP access to your email account they can replace an existing mail with a new version - see IMAP - editing a draft or existing message?. This gets reflected to the mail server and thus to all connected clients too.
This does not mean that this has actually happened in your situation but is a possible attack path.
IMAP allows to edit messages stored server-side and a proper IMAP client verifies whether the downloaded message matches what's stored on the server which means this attack is very much possible.
PGP/digital signature allows to prevent this.
