Smishing
Smishing, short for SMS phishing, is phishing delivered by text message: the attacker sends an SMS (or a chat message on a messaging app) that pushes the target to open a link to a fake sign-in page, call a number, or install an app. MITRE ATT&CK lists it under Phishing (T1660) for Android and iOS, noting that attackers use "social engineering techniques in text messages to trick the victims into acting quickly."
In identity attacks the text is a delivery step, and the payload is a credential and MFA relay. The 0ktapus campaign in 2022 sent texts linking to fake Okta pages and, per Group-IB, captured 9,931 credential sets and 5,441 MFA codes from more than 130 organizations; Twilio was one victim. In the 2023 Retool incident a payroll-themed text was followed by a deepfaked IT call that collected the MFA code.
| Smishing | Related but different |
|---|---|
| Lure arrives by SMS or messaging app | Vishing: the lure is a phone call |
| Usually links to a credential-harvesting page | SIM swap: attacker takes over the phone number itself |
| Defeated by origin-bound authenticators | Not stopped by SMS or TOTP codes, which the page relays |
It matters because mobile screens hide the full URL and texts feel personal, and because the same channel often carries the OTP the attacker wants. The fix that worked in the record is technical: Cloudflare was targeted by the same 0ktapus wave and stopped it with FIDO2 security keys, because a passkey or security key will not sign for a lookalike domain. Training helps at the margin; phishing-resistant MFA closes the gap. Note that NIST SP 800-63B-4 already treats SMS as a restricted authenticator.
See also: OTP relay social engineering, AiTM phishing proxy, phishable MFA, adversary-in-the-middle, best phishing-resistant MFA
Related on Start with Identity
- GlossaryNumber Matching
Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve,
- GlossaryBrowser-in-the-Browser (BitB)
Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, o
- GlossaryCredential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot
- BlogDexcom says targeted vishing calls led to access to internal documents
Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no
- BlogIndia mandates registered caller name display (CNAP) on 4G and 5G networks from November 1
India's Department of Telecommunications has ordered all access providers to show callers' subscriber-registered names on incoming calls from November 1, 2026,
- BlogThe help desk is the perimeter: what October's vishing cases say about verifying callers
ASOS and Dexcom both traced October breaches to people being talked into access, and India will show a network-asserted caller name on calls from November 1. No