Is it possible for an attacker to change an email-attachment of a received email client-side and synchronize it via IMAP with Webmailer?

Is it possible for an attacker to change an email-attachment of a received email client-side and synchronize it via IMAP with Webmailer?

an attacker manipulated the IBAN of an invoice.pdf attached to a received email. The question remains, can said attacker manipulate/change such a pdf client-side and cause an IMAP synchronization with the webmailer provided by a hoster?

I couldn't find a solution to this attack scenario, maybe you guys can provide a hint.

best