PDF Phishing: The Hidden Mobile Threat

**Executive summary:** Zimperium researchers detail two active mobile-first PDF-based phishing campaigns that weaponize SMS/MMS to deliver malicious PDFs—one targeting EZDriveMA using a Domain Generation Algorithm to spawn ~2,145 fast-rotating phishing domains for credential harvesting, and a PayPal-mimic that combines obfuscated links, direct-IP hosting (146.70.41.215:81) and a disposable VoIP number (+1-804-816-5249) to enable both phishing and vishing; the report includes IOCs, attack flow stages, and detection timing metrics demonstrating on-device ML detection identified threats hours to days before public lists.