Scammers Exploit SMS Gateways to Send Texts from Users' Own Numbers, Posing Phishing and Malware Risks
Scammers are increasingly using SMS gateway services to send text messages that appear to originate from the recipient's own phone number. This tactic is designed to bypass skepticism towards unknown numbers, making the messages seem more legitimate and urgent. A study involving 83 spoofed texts across four test lines over 90 days revealed that 67% of these messages led to credential-harvesting phishing pages, while 22% attempted to install malicious app profiles. These phishing pages are often sophisticated, using valid HTTPS certificates and mimicking legitimate brand designs, with the only reliable indicator of fraud being an incorrect URL domain. The texts typically arrive during peak engagement hours, between 8:00 AM and 11:00 AM or 6:00 PM and 9:00 PM local time, suggesting optimized automated scheduling. The phone numbers targeted by these scams are often obtained from data brokers, data breaches, or online form submissions, indicating that scammers purchase this information rather than hacking indi...
