Smishing and Carrier Impersonation

mobile-ransomware-filecoderCWhile most phishing campaigns involve email, SMS text messages are an ideal alternative for attackers, according to Paul Ducklin at Naked Security. Text messages are brief and uniform in appearance, so there aren’t many indicators to raise suspicion. They also come from a phone number rather than an email address, so the recipient can’t examine the address for signs of illegitimacy. Additionally, legitimate text messages frequently make use of shortened, strange-looking links, so recipients are less inclined to be suspicious of an unfamiliar URL.

SMS phishing (or “Smishing”) campaigns often impersonate mobile phone providers, since people are expecting to receive these types of texts. Ducklin cites one example in which the scammers sent text messages purporting to come from EE, one of Britain’s largest mobile providers. The messages told recipients that they needed to update their billing information, and included a link to a phishing page. The URL of the page began with subdomains that mimicked EE’s legitimate website.

Ducklin notes that the scammers didn’t need to target this campaign, since they could get a rough idea of phone numbers based in the UK, and a decent amount of these would be EE customers. Presumably, enough people will fall for the scam that the attackers will probably make far more money than it cost to send out thousands of SMS messages.

Scammers will take advantage of any venue they can use to trick people into giving them data or money. New-school security awareness training can help your employees avoid falling victim to these attacks.

Don’t get hacked by social media phishing attacks!

Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization's reputation, or gain access to your network.

KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.

SPT-monitorHere's how the Social Media Phishing Test works:

  • Immediately start your test with your choice of three social media phishing templates
  • Choose the corresponding landing page your users see after they click
  • Show users which red flags they missed or send them to a fake login page
  • Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Free Phishing Security Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews