Opened a PDF file on a phishing email - what do I do?

[Android Central Question]

On my Pixel 2, I have the Outlook app. I got an email that I thought looked ok from "Paypal," and I opened it. It had a PDF attachment thumbnail and I clicked on it, and it showed me the PDF that had a link to a site. I clicked on the link and I got directed to a site that looks like the normal Paypal login website but with a weird unverified URL. I realized that it was a phishing scam at this point and did not enter any of my login credentials to this site! Since I opened it, I've changed my PayPal and email passwords just in case, but my real concern is whether or not I downloaded that PDF or just previewed it, and whether doing that could have infected my phone! I tried looking in my phone's downloads folder for the PDF file but I didn't see it there - but I usually have a hard time finding things I've downloaded on purpose on my phone, so it could still be there!

I shut off my WiFi and data because I read that somewhere, but I don't know what next steps to take. Should I just delete everything in my downloads folder? Is there a good antivirus I can use on the Pixel? What am I looking at if it is infected - will I be able to tell or will they just quietly be able to steal all my info? Who do I call for help: Google? Verizon (my cell phone carrier)? Outlook? PayPal???

ANY HELP is really appreciated!!!

TL;DR: Does clicking on a PDF preview on the Outlook Android app download the PDF or preview it? I'm concerned I have a virus.

 

[B. Diddy]

Welcome to Android Central! It's highly unlikely that the act of downloading and viewing an actual PDF file installed any malware (especially if you had Unknown Sources turned off). They were trying to get you to enter your login credentials and password, which you caught in time. I wouldn't worry too much about it. Probably the most I'd do is to take this opportunity to update the passwords on all of your sensitive accounts, and make sure 2-factor authentication is set up for those accounts that offer it (and make sure you avoid the SMS option for 2-factor when possible).