Likely this was a standalone PDF reader hack (rather than a browser), since those can have many more features and a much larger attack surface.

It says it was an offer letter, so my guess is that opening it in the browser came up with an error like "to be able to digitally sign this offer letter, please open it in a desktop PDF reader with full scripting support enabled :)"