Smishing is phishing delivered through SMS text messages or messaging apps. Attackers send fraudulent texts that impersonate banks, delivery services, or IT departments, pushing victims to fake login pages or malicious downloads. The personal, urgent feel of a text message often beats email skepticism.
Smishing frequently serves as the first step in credential theft and account takeover chains that later intersect with infostealer data. Groups like Scattered Spider have paired smishing with help-desk social engineering to devastating effect.
Read how a prolific group blends these techniques in our Scattered Spider analysis.