Smishing, short for "SMS phishing", is a form of cyber attack that uses text messages to trick people into revealing sensitive information or installing malware on their devices. Smishing attacks often involve sending fraudulent messages that appear to be from legitimate sources, such as a bank, social media site, or other trusted organization.

A cyber-criminal will send a text message to a victim's mobile phone that appears to be from a legitimate source and asks the victim to click on a link or call a phone number provided in the message.

The message usually contains a sense of urgency or other tactical moves that would entice an individual to click on a link.

The link or phone number usually leads to a fake website or automated phone system that asks the victim to provide sensitive information, such as their login credentials, credit card details, or social security number. 

The cybercriminal can then use this information for fraudulent activities, such as identity theft or financial fraud. Smishing attacks can also involve the installation of malware on the victim's device through a malicious link or attachment in the text message. 

Service providers can identify and stop smishing messages from reaching individual devices. Because the smishing messages must travel through a cellular network before reaching the cellphone, providers can run the network traffic through a security solution. 

Bank or Credit Provider: The threat actor will send a SMS message claiming that there is unauthorized activity or that money has been withdrawn from your account. The SMS will prompt the victim to click on a malicious link or ask for their banking credentials to fix the issue.

E-commerce Site: With the rise of online shopping, threat actors have taken advantage of the SMS communication between online shoppers and e-commerce sites. They will mask themselves as Amazon or other reputable e-commerce companies stating that something is wrong with their order or that there are free gift cards available. 

Prize Winner: Some threat actors attempt to induce victims to click on malicious links to claim an award. The SMS message will read something like “You have just won a $500 prize. CLICK HERE to claim your rewards.” Individuals should be weary of any communication that claims to be offering them free money.

Opportunistic attacks: Threat actors will look to take advantage of current events in order to garner attention to their digital messages. For example, during the COVID-19 pandemic, there was an increase in smishing messages sent about doctor appointments, vaccinations, and local outbreak warnings.

Be cautious of unsolicited text messages: If you receive a text message from an unknown sender, don't click on any links or attachments within the message. Be especially wary if the message is asking you to provide personal or sensitive information.

Educate yourself: Educate yourself about the different types of social engineering attacks, such as smishing, and learn how to identify and avoid them. Stay up to date on the latest security threats and best practices for protecting your personal information.

Implement Endpoint Security: Endpoint security solutions can be effective against smishing attacks that involve malware. They can detect and block malicious software from running on the device. However, endpoint security may not be effective against all types of smishing attacks, particularly those that rely on social engineering tactics to trick users into divulging sensitive information. 

Additionally, AI-enhanced scams have increased since the release of ChatGPT and using AI security to protect against smishing attacks on endpoint devices ands a crucial layer of protection and limits the amount of flagged text messages that a security team has to parse through. 

Many organizations recognize Dropbox as a trusted vendor, so employees and email security software alike are often unprepared to spot a Dropbox phishing email.  

When one company was targeted by a Dropbox phishing email scam, Darktrace used AI cybersecurity to identify the attack and keep it away from the targeted employee. While the employee eventually clicked the malicious link anyways, Darktrace was still able to neutralize the attack before it disrupted business.

Read the full blog and attack story here.

Darktrace's revolutionary approach to email security doesn't rely on insights gleaned from past data. Instead, it develops in-depth insights into the usage patterns of each setting and user.

By analyzing this information, Darktrace / EMAIL can quickly detect, flag, and address deviations. Our leading AI technology develops a typical usage profile for every user, which includes their relationships, link-sharing patterns, tone and sentiment, content, and more.

Darktrace / EMAIL stops sophisticated security risks to businesses through email fraud, such as generative AI attacks, data loss, supply chain attacks,  account takeovers, BEC, and ransomware, by understanding the human behind email communications instead of just basing strategies on past attacks.

Try our free demo or find out more about Darktrace / EMAIL in our Solution Brief.