Smishing

Smishing is a type of social engineering attack that uses SMS (text messages) to trick recipients into revealing personal information, installing malware, or visiting malicious websites. The term is a combination of "SMS" and "phishing."

Key Characteristics

• SMS-Based: Uses text messages as the attack vector
• Mobile Targeting: Specifically targets mobile device users
• URL Shortening: Often uses shortened URLs to hide malicious destinations
• Urgency Tactics: Creates false sense of urgency or fear

Advantages (for attackers)

• High Open Rates: SMS messages have high open rates
• Mobile Reach: Direct access to mobile devices
• Trust Exploitation: Users may trust SMS from known contacts
• Bypass Desktop Security: Can bypass email filters and desktop security

Disadvantages

• Personal Information Theft: Can lead to identity theft and fraud
• Malware Distribution: Can install malware on mobile devices
• Financial Loss: Direct access to mobile banking and payment apps
• Privacy Violations: Access to personal mobile data

Best Practices

• Do not click links in unsolicited text messages
• Verify identity of sender through independent channels
• Use mobile security solutions with URL filtering
• Report suspicious messages to carriers or authorities

Use Cases

• Mobile banking credential theft
• Mobile app malware distribution
• Two-factor authentication bypass attempts
• Personal information harvesting