Smishing explained: what SMS phishing is and how to defend against it

Key insights

  • Smishing dominates mobile phishing. SMS-based attacks account for 69.3% of all mobile-targeted phishing (mishing), with incidents rising 22% year-over-year.
  • Enterprise breaches start with a text. High-profile compromises at Twilio, Uber, and MGM Resorts all traced back to SMS-based social engineering as the initial access vector.
  • Phishing-as-a-service platforms industrialize smishing. Criminal ecosystems like Darcula and Lucid have registered over 194,000 malicious domains since January 2024, now leveraging generative AI for multilingual lure generation.
  • SMS-based MFA is a liability. CISA and the FBI explicitly recommend against SMS-based multi-factor authentication, urging organizations to adopt phishing-resistant FIDO2/WebAuthn alternatives.
  • Post-compromise detection is essential. When a smishing message bypasses prevention controls, behavioral analytics and AI-driven signal analysis catch the attacker's next moves — credential abuse, lateral movement, and data exfiltration.

Every day, billions of text messages reach mobile devices worldwide. Attackers know this — and they exploit the trust people place in SMS to bypass the email security controls that organizations have spent years building. According to the Verizon 2025 Data Breach Investigations Report, 16% of breaches began with phishing and 60% involved a human action, making social engineering the most persistent initial access vector in cybersecurity. Smishing — phishing delivered via text message — has surged to become the dominant channel for mobile-targeted attacks, driving $470 million in consumer losses in 2024 alone according to the FTC. For security teams, smishing is no longer a consumer nuisance. It is an enterprise-grade threat that demands a layered defense strategy.

What is smishing?

Smishing is a social engineering attack in which criminals send fraudulent text messages — via SMS, RCS, or iMessage — to trick recipients into clicking malicious links, revealing sensitive information, or installing malware. The term combines "SMS" and "phishing" to describe this mobile-first attack vector.

Smishing sits within the broader mishing taxonomy, an umbrella term coined by Zimperium for all mobile-targeted phishing attacks, including voice phishing (vishing) and QR code phishing (quishing). Of all mishing attack types, smishing is by far the most prevalent. According to the Zimperium 2025 Global Mobile Threat Report, 69.3% of all mobile-targeted phishing attacks are SMS-based.

The scale of the problem is growing rapidly. Smishing incidents rose 22% year-over-year in 2025 according to Zimperium research, and 75% of organizations experienced smishing attacks in 2023 according to the Proofpoint 2024 State of the Phish report — the most recent available annual survey data on organizational smishing prevalence.

Why smishing is an enterprise threat

The reason smishing works so well is simple: people trust text messages. SMS click-through rates range from 8.9% to 14.5%, compared to roughly 2% for email phishing. Messages arrive on personal devices that may lack enterprise security controls, and the small screen format makes it harder to inspect URLs before tapping.

The enterprise consequences are severe. The Twilio breach of August 2022, the Uber compromise of September 2022, and the MGM Resorts attack of September 2023 all began with SMS-based or mobile social engineering as the initial access vector. These were not consumer scams. They were coordinated campaigns by sophisticated threat actors — and they resulted in hundreds of compromised accounts, internal system access, and losses exceeding $100 million.

How smishing attacks work

A smishing attack follows a predictable chain, though the sophistication of each stage has increased dramatically with the rise of phishing-as-a-service (PhaaS) platforms and generative AI.

Attack flow:

  1. Lure creation — The attacker crafts a text message designed to trigger urgency, fear, or curiosity. Messages impersonate banks, government agencies, employers, or delivery services.
  2. Message delivery — The lure is sent via traditional SMS, RCS, or iMessage. PhaaS platforms now exploit all three channels to bypass carrier-level filtering.
  3. Victim interaction — The recipient taps a link, which redirects to a credential harvesting page designed to mimic a legitimate login portal, or triggers a malware download.
  4. Data exfiltration — Harvested credentials are used for account takeover, unauthorized access, or sold on criminal marketplaces.
  5. Post-compromise activity — Attackers use stolen credentials for lateral movement, privilege escalation, and deeper network penetration.

Several emerging delivery techniques make smishing harder to detect. Apple's iMessage disables links from unknown senders by default, but attackers now instruct recipients to "Reply Y" to re-enable them — a technique documented by BleepingComputer that effectively bypasses Apple's built-in phishing protection. In the United Kingdom, authorities arrested individuals using vehicle-mounted SMS blasters — physical devices that mimic cell towers to send smishing messages directly to nearby phones, completely bypassing carrier filtering (SecurityWeek). Researchers at Sekoia also documented silent smishing campaigns exploiting vulnerable router APIs (CVE-2023-43261 on Milesight routers) to send messages without the device owner's knowledge (Sekoia).

Can you get hacked by responding to a text? In many cases, yes. Simply replying to a smishing message confirms that the number is active and may trigger further targeting. In the iMessage "Reply Y" scenario, responding directly disables a security control, exposing the user to malicious links.

The phishing-as-a-service ecosystem

The most significant shift in the smishing landscape is the emergence of phishing-as-a-service (PhaaS) platforms that provide turnkey criminal infrastructure at industrial scale. Platforms like Darcula, Lucid, and Lighthouse offer ready-made smishing kits — including message templates, credential harvesting pages, delivery infrastructure, and tracking dashboards — for as little as $8 per 1,000 messages through services like Oak Tel (Resecurity).

The numbers are staggering. Unit 42 research identified 194,345 malicious domains linked to China-based smishing campaigns since January 2024, with approximately 600 criminal groups using the infrastructure. In a seven-month period, roughly 884,000 payment cards were compromised through these platforms alone (Infosecurity Magazine).

The integration of generative AI makes these platforms even more dangerous. In April 2025, Darcula added GenAI capabilities for automated multilingual phishing form generation (The Hacker News), enabling operators to create convincing lures in any language without human translation. Research suggests that LLM-generated smishing messages are 24% more effective than human-crafted ones, further lowering the barrier to entry for AI-powered phishing campaigns.

Google filed RICO lawsuits against the operators of Darcula and Lighthouse in late 2025 (NBC News), signaling a legal escalation against PhaaS infrastructure. However, the decentralized nature of these platforms means takedowns have limited lasting effect.

Types of smishing attacks

Smishing attacks vary by lure type and target. The following table summarizes the most common categories, each backed by real-world campaigns observed by security researchers.

Common smishing attack types and their distinguishing characteristics:

Type Common lures Target Risk level
Financial institution impersonation "Suspicious activity on your account," "Account locked" Banking credentials, card numbers High
Government/agency impersonation Unpaid tolls, tax refunds, benefits verification PII, payment details High
Shipping/delivery notifications "Package could not be delivered," tracking updates Payment details, credentials Medium
IT/employer impersonation Password resets, SSO credential harvesting, policy updates Enterprise credentials, MFA codes Critical
Prize/reward scams Gift cards, lottery winnings, loyalty rewards Payment details, PII Medium
MFA code theft "Verify your identity," fake MFA prompts One-time passwords, session tokens Critical
"Wrong number" conversational scams Friendly misdirected messages that initiate trust-building Financial exploitation (pig butchering) High

Financial institution and government impersonation remain the most common lure types. The FBI toll-fee campaign of 2025 — discussed in detail below — exemplifies the government impersonation category at massive scale. IT and employer impersonation attacks pose the highest risk to enterprises because they target SSO credentials and can lead directly to data breaches affecting the entire organization.

Targeted smishing campaigns share many tactics with spear phishing, using LinkedIn reconnaissance and personalized lures to increase credibility. The difference is the delivery channel — and the higher click rates that SMS provides.

Smishing vs phishing vs vishing

Understanding the differences between smishing, phishing, and vishing is critical for building a comprehensive defense. While all three are social engineering attacks, they differ in delivery channel, effectiveness, and the controls required to detect them.

Comparison of phishing, smishing, and vishing attack vectors:

Attack type Channel Common lures Key defense
Phishing Email Invoice fraud, credential harvesting, malware attachments Email security gateways, DMARC, user training
Smishing SMS, RCS, iMessage Toll fees, delivery alerts, account warnings, MFA requests Mobile threat defense, FIDO2 MFA, carrier filtering
Vishing Voice calls Tech support scams, help desk impersonation, IRS fraud Call verification protocols, employee training
Quishing QR codes Parking meters, restaurant menus, fake invoices URL inspection, mobile security apps

The most important trend is convergence. Modern threat actors rarely rely on a single channel. The Scattered Spider group combines smishing and vishing in coordinated campaigns, and the ShinyHunters operation of January–February 2026 breached 15+ organizations using vishing and social engineering that resulted in over 50 million leaked records (Help Net Security). Defenders who treat smishing, phishing, and vishing as separate problems will miss multi-channel attack chains.

Smishing in practice: real-world attacks and FBI warnings

The following case studies demonstrate why smishing is an enterprise-grade initial access vector — not a consumer nuisance.

Twilio breach (August 2022). Scattered Spider sent SMS messages to current and former Twilio employees impersonating the IT department, claiming passwords had expired. Employees who clicked the link were redirected to a fake SSO portal. The result: 209 customer accounts compromised, plus 93 Authy end-user accounts. The lesson: SMS-based credential harvesting can compromise an entire customer base (The Hacker News).

Uber MFA fatigue attack (September 2022). An attacker purchased stolen Uber employee credentials, contacted the employee via WhatsApp, and bombarded them with MFA push notifications until the employee approved one out of frustration. The attacker gained access to G-Suite, Slack, and internal tools. The lesson: SMS and push-based MFA alone are insufficient — organizations need number-matching MFA and push attempt limits (UpGuard).

MGM Resorts and Caesars (September 2023). Scattered Spider used LinkedIn reconnaissance plus help desk social engineering to gain password and MFA resets. MGM suffered $100 million in Q3 losses. Caesars paid approximately $15 million in ransom. The lesson: social engineering bypasses technical controls by targeting human processes — help desk identity verification must be hardened (CISA advisory AA23-320A).

FBI toll-fee smishing campaign (March 2025). The FBI received over 2,000 complaints about smishing texts impersonating state road toll agencies across more than 10 states. Palo Alto Networks identified over 10,000 domains registered for these scams, linked to Chinese cybercriminal groups (FBI Atlanta). This campaign demonstrates the scale at which PhaaS infrastructure enables government impersonation.

ShinyHunters multi-channel campaign (January–February 2026). ShinyHunters breached 15+ organizations through combined vishing and social engineering, leaking over 50 million records. The campaign illustrates the convergence trend — smishing, vishing, and social engineering now operate as coordinated kill chains, not isolated tactics.

Each of these incidents underscores the need for incident response plans that account for mobile-initiated compromises and the lateral movement that follows initial access.

Detecting and preventing smishing

How to identify smishing texts

Recognizing smishing requires looking beyond grammar errors — AI-generated messages are increasingly polished and error-free. Focus on these behavioral indicators instead:

  • Unexpected urgency. "Act now or your account will be suspended" is a pressure tactic designed to override careful thinking.
  • Unknown sender numbers. Legitimate organizations rarely initiate sensitive communications via text from unfamiliar numbers.
  • Shortened or suspicious URLs. Bit.ly links, misspelled domains, and unfamiliar subdomains are red flags.
  • Requests for credentials or personal information. No legitimate bank, employer, or government agency asks for passwords or SSNs via text.
  • Generic greetings. "Dear customer" or "Dear user" instead of your name often signals a mass campaign.

What to do when you receive a smishing text

  1. Do not click any links or reply to the message
  2. Forward the suspicious text to 7726 (SPAM) to report it to your carrier
  3. Report the message to ReportFraud.ftc.gov and IC3.gov
  4. Delete the message
  5. If the message appears legitimate, contact the organization directly through their official website or phone number
  6. If you already clicked a link, disconnect from the internet, change passwords for any entered accounts, enable account monitoring, and contact your financial institution

Effective threat detection at the organizational level requires more than user awareness. Behavioral analytics solutions can identify anomalous authentication patterns, unusual access attempts, and credential abuse that follow a successful smishing attack — even when the initial message was not intercepted.

Enterprise smishing defense framework

Consumer-oriented advice — "don't click suspicious links" — is necessary but insufficient for enterprise security. Organizations need a layered defense architecture that addresses smishing across the full attack lifecycle.

Phishing-resistant MFA. Replace SMS-based one-time passwords with FIDO2/WebAuthn hardware security keys or biometric authentication. NIST SP 800-63 restricts SMS-based authentication for federal systems, and CISA's December 2024 Mobile Communications Best Practice Guidance explicitly recommends against SMS-based MFA. This is no longer optional guidance — it is the security baseline. The GSA's CIO-IT Security-21-112 Rev 1, published January 2026, mandates phishing-resistant multi-factor authentication for nonfederal systems handling controlled unclassified information.

Mobile threat defense (MTD). Deploy MTD solutions on enterprise mobile devices to detect and block malicious links in real time, as recommended by the CIS Controls Mobile Companion Guide.

MDM/MAM enforcement. Mobile device management and mobile application management enforce security policies, restrict unauthorized app installation, and enable remote wipe for compromised devices.

Smishing simulation training. Extend phishing simulation programs to include SMS-based exercises. Organizations that only test email awareness miss the channel where click rates are four to seven times higher (Hoxhunt).

Help desk hardening. The MGM and Caesars breaches demonstrated that social engineering bypasses technical controls by targeting human processes. Implement multi-layered identity verification for all credential resets, as recommended in CISA advisory AA23-320A.

SIEM integration. Unify mobile threat alerts with existing SOC operations workflows. Smishing-initiated compromises generate the same post-access behaviors — credential abuse, privilege escalation, lateral movement — as any other initial access vector. Your SOC needs visibility across all channels.

MITRE ATT&CK mapping for smishing

Mapping smishing to the MITRE ATT&CK framework enables detection engineering teams to build targeted analytics and compliance teams to document coverage. No major competitor currently provides this mapping, yet it is foundational for enterprise security operations.

MITRE ATT&CK techniques relevant to smishing attacks:

Technique ID Technique name Tactic Relevance to smishing Detection strategy
T1566 Phishing: Spearphishing Link Initial Access (Enterprise) SMS messages containing malicious URLs targeting enterprise credentials Monitor for anomalous authentication from new devices following credential entry
T1660 Phishing (Mobile) Initial Access (Mobile) Explicitly covers SMS-based phishing as a mobile initial access vector MTD solutions detecting malicious URLs on mobile devices
T1566.003 Spearphishing via Service Initial Access (Enterprise) Smishing delivered via iMessage, RCS, or WhatsApp Monitor third-party messaging service traffic for credential harvesting indicators
T1636.004 Protected User Data: SMS Messages Collection (Mobile) Post-compromise harvesting of SMS messages including MFA codes Detect unauthorized access to SMS APIs or message stores on mobile devices
T1582 SMS Control Command and Control (Mobile) Malware using compromised device SMS capabilities to spread smishing Monitor for anomalous outbound SMS patterns from enterprise-managed devices

Regulatory and compliance context

Enterprise smishing defense maps directly to established compliance frameworks:

  • NIST CSF functions. Identify (asset inventory including mobile devices), Protect (phishing-resistant MFA), Detect (MTD and behavioral analytics), Respond (incident response for mobile-initiated compromises).
  • NIST SP 800-63. Restricts SMS-based authentication for federal systems due to SIM swapping and interception risks.
  • CISA/FBI December 2024 guidance. Explicitly recommends against SMS-based MFA for all organizations, not just federal agencies.
  • CIS Control 14. Security awareness and skills training covering smishing as a distinct attack vector.
  • CIS Controls Mobile Companion Guide. Recommends MDM, MTD, and mobile antivirus technologies for enterprise mobile device protection.

Modern approaches to smishing defense

The security industry is evolving its approach to smishing from prevention-only to detection-and-response. AI-powered detection models now achieve a 96.2% smishing detection rate, compared to 25–35% for traditional commercial filtering tools, according to aggregated 2025–2026 research. This gap highlights the limitations of rule-based and signature-based approaches when facing AI-generated, multilingual lures delivered across SMS, RCS, and iMessage channels simultaneously.

Behavioral analytics plays a critical role in defending against smishing at the enterprise level. Rather than attempting to block every malicious text message — an increasingly difficult proposition — organizations benefit from detecting the post-compromise behaviors that follow a successful smishing attack: anomalous credential usage, lateral movement across networks and cloud environments, privilege escalation, and data exfiltration. Unified detection across the full attack surface — network, identity, cloud, and SaaS — ensures that smishing-initiated compromises are caught regardless of the initial access channel.

Organizations evaluating managed detection and response (MDR) and network detection and response (NDR) solutions should assess whether those solutions provide visibility into the post-compromise activity chain that smishing initiates, not just the SMS delivery itself.

How Vectra AI approaches smishing defense

Smishing is often the first step in a multi-stage attack. Vectra AI's Attack Signal Intelligence focuses on detecting the post-compromise behaviors that follow a successful smishing attack — credential abuse, lateral movement, privilege escalation, and data exfiltration — across the modern network spanning on-premises, cloud, identity, and SaaS environments. This assume-compromise approach means that even when a smishing message bypasses prevention controls, the attacker's subsequent actions are detected and prioritized through AI-driven behavioral analysis rather than relying on signatures alone. By correlating signals across identity threat detection and response (ITDR) and network detection, Vectra AI helps SOC teams see and stop the attacks that start with a text message.

Future trends and emerging considerations

The smishing threat landscape is evolving on multiple fronts, and organizations should prepare for several key developments over the next 12–24 months.

RCS adoption expands the attack surface. Apple's adoption of RCS in 2025 means that PhaaS platforms now have three messaging channels — SMS, RCS, and iMessage — to exploit. RCS messages can include richer formatting and branding that makes smishing lures more convincing, and the security posture of RCS implementations varies by carrier and device manufacturer.

Generative AI accelerates smishing sophistication. The integration of GenAI into PhaaS platforms (as Darcula demonstrated in April 2025) enables automated, multilingual, and contextually personalized lures at scale. Organizations should expect smishing messages to become increasingly indistinguishable from legitimate communications, rendering grammar-based detection obsolete.

Regulatory momentum is building. NIST SP 800-63-4 is expected to finalize publication in 2026, likely strengthening restrictions on SMS-based authentication. The GSA's January 2026 mandate for phishing-resistant MFA on systems handling controlled unclassified information signals a broader federal push that private sector organizations will likely follow. Security leaders should begin FIDO2 migration planning now rather than waiting for mandates.

PhaaS infrastructure continues to decentralize. Despite Google's RICO lawsuits and law enforcement operations, PhaaS platforms regenerate infrastructure quickly. Organizations should invest in real-time URL reputation checking, AI-powered detection, and post-compromise behavioral analytics rather than relying solely on carrier-level filtering.

Conclusion

Smishing has matured from a consumer annoyance into one of the most effective initial access vectors threatening enterprise security. The combination of high SMS click-through rates, industrialized PhaaS infrastructure, and generative AI means that the volume, sophistication, and success rate of smishing attacks will continue to increase.

The path forward is not prevention alone. Organizations that assume compromise — recognizing that some smishing messages will reach employees and some employees will click — are better positioned to detect and stop attacks before they cause damage. This requires phishing-resistant MFA, mobile threat defense, simulation training, hardened processes, and behavioral detection that catches attackers after initial access.

The best defense against smishing is the same defense that works against every initial access vector: visibility across the entire attack surface, AI-driven signal to cut through noise, and the ability to act before attackers achieve their objectives.

Explore how Vectra AI detects post-compromise threats across network, identity, cloud, and SaaS environments.

Related cybersecurity fundamentals

FAQs

What is smishing?

What is the difference between smishing and phishing?

How do I know if a text is a smishing attempt?

What should I do if I receive a smishing text?

What happens if you click on a smishing link?

Is smishing a crime?

What is the best defense against smishing?

What is mishing?

What is the difference between smishing and quishing?

How do you prevent smishing attacks in the workplace?