USPS Impersonators Tap Trust in PDFs in Smishing Attack Wave

Researchers at Zimperium zLabs uncovered a large-scale USPS-themed smishing campaign that sends malicious SMS messages pointing victims to PDF files containing hidden phishing links; the landing pages harvest names, addresses, emails, phone numbers and payment-card data. The attackers employ a novel evasion technique by embedding clickable links without the standard /URI PDF tag, allowing many endpoint security products to miss the malicious URLs; investigators found 20 malicious PDFs, over 630 phishing pages, and infrastructure spanning more than 50 countries.