Employees are increasingly accessing corporate information and accounts from their personal phones. As a result, SMiShing attacks now pose a serious threat to corporate information. How serious is this threat? Consider this statistic; 20% of energy industry employees were exposed to a mobile phishing attack in the first half of 2021. That is a 161% increase from the second half of 2020. Across the board, companies lost an alarming $54,241,075 because of social attacks including SMiShing according to the 2020 FBI Internet Crime Complaint Center report.
What is SMiShing?
The word SMiShing comes from combining SMS (Short Message Service), the technology behind texting, with phishing, the practice of stealing personal or financial information through deceptive emails. Basically, SMiShing is phishing but by another means, namely text messages on mobile devices.
The following social engineering news stories show how criminals are SMiShing for victims.
- A malware campaign dubbed TangleBot uses COVID-themed text messages in order to steal personal information and credentials. Reporting on this threat is Jacinta Tobin, vice president of global sales and operations at the Cloudmark division of Proofpoint. “With TangleBot, even if just one employee’s device gets infected, an attacker can launch either a widespread or spear-smishing attack.”
- A SMiShing campaign impersonating the international parcel delivery firm DPD is making the rounds. Recipients receive a text that says: “DPD: We tried to deliver your parcel however no one was available to receive it. To arrange your redelivery, please proceed via: *link.” The link takes the recipient to a fake DPD website. The recipient is then instructed to supply personal information for a redelivery fee to receive their package.
- Criminals combine social engineering tactics with SMS messages to install malware on Android devices. It all begins with a fake notification impersonating the Iranian Judiciary. The fake notification urges users to review a supposed complaint filed against them. Indeed, it’s all part of a widespread campaign to steal credit card details and money from victims’ bank accounts.
Image: https://thehackernews.com/2021/12/researchers-warn-iranian-users-of.html
Test, Educate, and Protect
Your company’s best defense is to educate employees and ensure they understand the threats posed by SMiShing attacks. The Social-Engineer Teaming Service is a valuable tool that enables organizations to evaluate their unique attack surface to social engineering attacks. Upon request, we can include a SMiShing part to our SE (Social-Engineer) Teaming Service engagement. This will test your organization’s human network for their understanding of policies relating to SMS attacks.
