SMS-Based Authentication and Phishing Risks via Intercepted or Mass-Sent Text Links
Recent research highlighted systemic security and privacy risks created by sign-in/authentication links delivered over SMS, showing how easily such links and embedded personal data can be exposed and abused at scale. By observing public SMS gateway services (temporary numbers used to receive texts), researchers collected 332,000 unique SMS-delivered URLs extracted from 33 million texts sent to 30,000+ phone numbers, and reported that messages from 701 endpoints on behalf of 177 services exposed critical PII. The work underscores that SMS is unencrypted and that authentication links and sensitive details can persist in accessible stores or be captured through weakly protected SMS delivery ecosystems.
Greek police separately dismantled a criminal operation in the Athens area that used a rogue mobile base station (an “SMS blaster”) concealed in a car to push phishing texts to nearby phones. Authorities said the device coerced phones to connect and downgraded them from 4G to 2G, enabling collection of identifiers (e.g., phone numbers) and delivery of scam messages impersonating banks and courier firms with phishing links used to steal payment card data and conduct unauthorized transactions; investigators have tied the group to at least three fraud cases and indicated the suspects may be Chinese nationals. Together, the reporting and research illustrate how SMS-delivered links can be exploited both through passive exposure of messages/URLs and through active, proximity-based telecom impersonation to distribute credential- and payment-theft lures.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Investigators link Athens-area SMS blaster gang to at least three fraud cases
Authorities said the rogue base station was used to force nearby phones onto 2G networks, collect identifiers, and send phishing texts impersonating banks or courier companies to steal payment card data. Investigators linked the suspects to at least three fraud cases in Maroussi, Spata, and Athens, and the suspects were brought before a prosecutor.
Greek police stop suspects in Spata and uncover rogue cell tower
Greek authorities dismantled a mobile phishing operation in the Athens area after stopping suspects in Spata following reports of suspicious behavior. Police found forged identity documents and a fake cellular base station hidden in a car trunk, with a transmitter disguised as a shark-fin antenna.
Study finds 701 exposed SMS endpoints across 177 services
The researchers reported evidence that SMS-delivered authentication links could expose sensitive data at scale, identifying 701 endpoints across 177 services. They found messages and linked endpoints exposing critical personal information such as Social Security numbers, dates of birth, bank account numbers, and credit scores.
Researchers analyze SMS-delivered sign-in links at internet scale
Researchers from the universities of New Mexico, Arizona, and Louisiana, along with Circle, studied SMS authentication links using public SMS gateways and temporary numbers. Across 33 million texts sent to more than 30,000 phone numbers, they collected 332,000 unique URLs to assess how widely SMS-delivered links expose users.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
Millions of people imperiled through sign-in links sent by SMS - Ars Technica
arstechnica.com
Open sourceGreek police arrest scammers using fake cell tower hidden in car trunk | The Record from Recorded Future News
therecord.media
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rise of SMS-Based Mobile Fraud Through Smishing and OTP Interception
Criminals are increasingly abusing **SMS as a fraud channel**, using both network-level and device-level techniques to bypass traditional defenses and steal credentials, banking data, and one-time passcodes. One reported method uses **SMS blasters**—portable false base stations or cell-site simulators—to inject phishing texts directly into nearby phones without traversing carrier networks, allowing messages spoofing government agencies or banks to evade carrier spam filtering. Another technique targets Android devices through the **LSPosed** framework and the **Digital Lutera** module, enabling attackers to capture SMS verification tokens, impersonate phone numbers, insert fraudulent SMS records, and support real-time payment app account takeover and transaction approval. The fraud ecosystem also includes large-scale **smishing campaigns** built around fake parcel delivery notifications, with Group-IB reporting sustained growth across the Middle East and Africa and postal brands most frequently abused. Those campaigns use urgent shipment-tracking lures to drive victims to counterfeit courier sites that harvest personal data, card details, banking credentials, and OTPs. Together, the reporting shows that mobile fraud is expanding through both social engineering and deeper technical abuse of telecom and mobile operating system trust models, exposing weaknesses in SMS-based authentication and message trust assumptions.
Jun 29, 2026
Security Risks From Phishing URLs and Long-Lived SMS “One-Time” Links
*1Password* introduced a new anti-phishing UX control that displays **pop-up warnings** when users land on suspected phishing or typosquatted domains, addressing a gap where users might manually type credentials even when the password manager refuses to autofill due to a URL mismatch. The feature is enabled by default for *Individual* and *Family* plans, while enterprise admins can enable it via **Authentication Policies** in the 1Password admin console. Separate academic/industry research highlighted systemic exposure risks from **SMS-delivered “one-time” links** that do not expire, enabling personal data access long after delivery. The study assembled a dataset from public SMS gateways (over **33M messages**, **323K unique URLs**, and **10.9K+ domains**) to analyze how SMS link design choices can leak data over time; the article also notes broader threat trends where attackers increasingly use **malicious URLs via SMS (smishing)** and large-scale domain churn/brand impersonation to drive credential theft and fraud.
Jun 29, 2026
Fake CAPTCHA SMS Fraud and SMS Blaster Smishing Target Mobile Users
Infoblox researchers reported a long-running **International Revenue Share Fraud (IRSF)** campaign that uses fake CAPTCHA pages to trick mobile users into sending premium-rate international text messages. Victims are funneled through typosquatted telecom-themed domains, ad-network redirects, and **Traffic Distribution System (TDS)** infrastructure to scam landing pages that present bogus verification steps. Those prompts trigger JavaScript that opens the phone’s SMS app with pre-filled messages and dozens of international numbers, and a single four-step interaction can generate about **60 SMS messages to more than 50 destinations**, costing roughly **$30 or more** per session. Researchers said the operation has been active since at least 2020, uses high-fee destinations including **Azerbaijan, Egypt, and Myanmar**, and has been linked to an affiliate of a European **Click2SMS** network using infrastructure hosted on **AS15699, Adam Ecotech**. Separately, Toronto police arrested three men in what authorities described as Canada’s first criminal case involving a mobile **SMS blaster**, a rogue device that impersonates a cellular tower to push phishing texts and disrupt legitimate service. Investigators said the devices were tracked across the Greater Toronto Area after one was detected in downtown Toronto, and police seized multiple SMS blasters and related equipment. Authorities believe **tens of thousands of phones** connected to the rogue system, contributing to more than **13 million network disruptions** that may have interfered with normal mobile access and even emergency services such as **911**. The cases highlight how attackers are abusing both web lures and fake base-station hardware to scale **smishing** and mobile billing fraud.
Jun 29, 2026