Cellular router APIs exploited in covert smishing campaign

Threat actors have abused Milesight Industrial Cellular routers' APIs to launch a wave of smishing attacks across Europe, according to Infosecurity Magazine.

Belgium was primarily targeted by such campaigns between November 2022 and July 2025, with routers exploited to deliver malicious SMS messages purporting to be from its government platforms CSAM and eBox, a report from Sekoia.io's Threat Detection & Research team showed.

Other attacks exploiting the router APIs involved the impersonation of French banking and postal entities, as well as Swedish and Danish telecommunications providers in smishing campaigns, noted researchers, who also found the use of NameSilo-registered phishing domains and infrastructure associated with Podaon, a hosting provider in Lithuania, in the intrusions.

"In light of this, heightened vigilance remains essential. Users should be cautious of unsolicited messages especially those containing shortened or suspicious URLs, spelling or grammatical errors or urgent calls to action. Awareness and skepticism are among the most effective defences against smishing attempts, which increasingly target both individuals and organisations on a global scale," said researchers.