In this case by emailing you a PDF with a convincing title that you might want to share with your coworkers - the malicious instructions are hidden as white text on a white background.
There are plenty of other possibilities though, especially once you start booking up MCPs that can see public issue trackers or incoming emails.