Phishing Attacks Target Telecom Companies and their Tools to Facilitate SIM Swapping Attacks

Female customer support operator with headset and smilingHackers are phishing telecom workers and “authorized retailers” to steal credentials and gain access to internal company tools. The end game is to modify SIM settings to help with a separate identity theft scam.

Attackers intent on installing malware that provides access to a victim’s network via phishing are looking for something within that network – it could be valuable data that can be sold on the dark web (such as the credit card data in the recent Wawa breach), or in the case of cellular companies, the goal is to access the internal application responsible for performing SIM swaps.

Attackers that want to commit identity theft online usually need to have a second factor of authentication – a mobile phone in most cases. So, how better to get control of that phone than to make the victim’s phone become attacker’s phone? And what easier way to do that than to simply phish the mobile telecom company, gain access to the responsible application, and just make the change?

This is the attack plan currently being seen by users at mobile companies such as T-Mobile, AT&T, Verizon, and Sprint.

The bad news here is that this kind of attack can have ramifications that impact millions of people. The good news is that phishing is an attack vector that is easily stopped. By using a combination of layered endpoint protection solutions and Security Awareness Training, both the employee’s device and the employee are acting as part of the organization’s security stance.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Anti-Phishing Guide ebook

Get the latest about social engineering

Subscribe to CyberheistNews