Smishing (SMS phishing): how the attack works and how to stop it

SMS credential harvesting bypasses corporate email security entirely, targeting employees through personal communication channels. Attackers impersonate IT support or security teams, directing victims to credential theft sites that capture usernames, passwords, and MFA codes in real-time. The business consequence: authenticated access to corporate systems without triggering email-based security monitoring.

Attack surfaces and threat vectors

Corporate phone number exposure creates the primary attack surface when organizations publish employee directories or maintain public contact databases. Threat actors enumerate these numbers through automated tools or purchase contact lists targeting specific industries. Mobile devices amplify this vulnerability because SMS messages appear directly on lock screens, requiring no user interaction to display malicious content.

The mobile browser environment reduces security awareness compared to desktop systems. Simplified address bars make domain verification harder, while smaller screen real estate obscures URL details that would reveal lookalike domains. Research from the Anti-Phishing Working Group and others has documented higher click-through rates for SMS-delivered phishing compared to email, attributed in part to the relatively young history of SMS as a phishing channel — users have had less time to develop the same skepticism applied to suspicious emails.

BYOD policies expand the attack surface by placing corporate authentication credentials on personal devices that lack enterprise security controls. These devices operate outside SMS filtering and mobile device management policies that would block malicious content. The tradeoff is employee productivity versus credential exposure through unmanaged communication channels.

Directory harvesting amplifies attack effectiveness when organizations maintain searchable employee databases. Attackers use corporate area codes and exchange patterns to generate targeted phone number lists. The downstream implication: systematic targeting of entire departments rather than random credential theft attempts.

Business impact

Harvested credentials provide immediate access to corporate applications, email systems, and cloud resources without triggering traditional security controls. It is important to distinguish between three related but separate attack outcomes: password theft grants direct account access; MFA code theft allows an attacker to complete an authentication challenge in real-time using a one-time code intercepted from the victim; and session token theft allows an attacker to hijack an already-authenticated session, bypassing both password and MFA requirements entirely. Each represents a distinct persistence mechanism and requires a distinct defensive response.

Customer trust erosion occurs when compromised corporate accounts send additional phishing messages to business partners and clients. This cascade effect transforms initial smishing compromise into broader business email compromise campaigns that damage business relationships and create potential liability for enabling secondary attacks.

Regulatory exposure increases when compromised accounts access sensitive data covered by privacy regulations. Healthcare organizations face HIPAA violations when attackers use harvested credentials to access patient records. Financial services encounter SOX and PCI compliance issues when compromised accounts access transaction data or payment systems.

The operational consequence: credential compromise that bypasses email security infrastructure creates blind spots in security monitoring. Detection systems focused on email-based phishing miss SMS-delivered attacks entirely, allowing sustained access before discovery.

Detection guidance

Monitor for authentication events that occur within minutes of inbound SMS messages to corporate phone numbers. This pattern indicates potential credential harvesting following smishing attempts — a user receives a malicious SMS and shortly thereafter submits credentials to an attacker-controlled site, which then replays them against the corporate environment.

-- Logic pattern / pseudocode — validate for your platform
SELECT auth.user_id, auth.timestamp, auth.source_ip, sms.timestamp as sms_time
FROM authentication_logs auth
JOIN sms_gateway_logs sms ON auth.user_phone = sms.recipient
WHERE auth.timestamp BETWEEN sms.timestamp AND sms.timestamp + INTERVAL 15 MINUTE
AND auth.user_agent LIKE '%Mobile%'
AND auth.result = 'SUCCESS'
ORDER BY auth.timestamp DESC

Track credential submissions to domains that closely resemble corporate infrastructure. Focus on newly registered domains with similar spelling to legitimate corporate sites.

-- Logic pattern / pseudocode — validate for your platform
SELECT DISTINCT destination_domain, source_ip, user_agent
FROM dns_logs
WHERE destination_domain SIMILAR TO '%company-name%|%companyname%|%company_name%'
AND domain_age < 30
AND user_agent LIKE '%Mobile%'

Correlate MFA code generation with immediate authentication attempts from mobile devices. This pattern suggests harvested MFA codes being used by an attacker in real-time to complete an authentication challenge before the code expires.

-- Logic pattern / pseudocode — validate for your platform
SELECT mfa.user_id, mfa.code_generated, auth.timestamp, auth.source_ip
FROM mfa_events mfa
JOIN authentication_logs auth ON mfa.user_id = auth.user_id
WHERE auth.timestamp BETWEEN mfa.code_generated AND mfa.code_generated + INTERVAL 5 MINUTE
AND auth.source_ip != mfa.source_ip
AND auth.user_agent LIKE '%Mobile%'

Monitor for authentication from mobile devices to corporate applications outside normal usage patterns. Flag access attempts during unusual hours or from unexpected geographic locations.

Essential log sources include SMS gateway logs, mobile device management telemetry, authentication system logs, and DNS resolution data. The detection tradeoff: real-time correlation versus storage and processing overhead for mobile device telemetry.

Mitigation strategies

SMS gateway filtering

An SMS gateway is an infrastructure component — operated by a carrier, a third-party messaging platform, or an enterprise — that routes SMS messages between the public telephone network and internal recipients. Enterprise SMS gateways can be configured with security policies that inspect message content, evaluate embedded links against threat intelligence feeds, and filter or quarantine messages that match suspicious patterns before they are delivered to corporate phone numbers.

This capability is conceptually similar to a secure email gateway, and organizations that operate their own SMS infrastructure or contract with enterprise messaging providers may have access to these controls. Like secure email gateways, SMS filtering reduces exposure but will not block every malicious message — determined attackers adapt their payloads to evade content-based detection, so gateway filtering should be treated as one layer of a defense-in-depth approach rather than a complete solution. Organizations that rely on carrier-provided SMS without an enterprise gateway layer may have limited visibility and control over inbound message filtering.

Deploy mobile device management policies that restrict browser access to newly registered domains. Configure MDM systems to quarantine devices that access known credential harvesting infrastructure. The operational tradeoff: employee access flexibility versus credential protection through device-level controls.

Replace SMS-based MFA with authenticator applications or hardware tokens that generate time-based codes independent of the SMS channel. NIST SP 800-63B explicitly identifies SMS-based authentication as a restricted authenticator type due to its susceptibility to interception, SIM swapping, and real-time phishing. Authenticator applications and hardware security keys, as described in NIST SP 800-63B and aligned with the FIDO2 standards referenced by OWASP, eliminate the dependency on the SMS channel entirely.

Configure authentication systems to flag login attempts that immediately follow inbound SMS delivery to the associated phone number. Implement additional verification steps when this correlation pattern appears. The challenge: establishing baseline timing patterns for legitimate password reset workflows to reduce false positives.

Establish corporate communication policies that prohibit IT support requests via SMS. Train employees to verify authentication requests through established channels before providing credentials. OWASP's guidance on phishing-resistant authentication reinforces that procedural controls and user awareness remain essential complements to technical defenses.

Monitor newly registered domains that closely resemble corporate infrastructure using domain monitoring services. Block access to lookalike domains through DNS filtering and web proxy controls.

Getting started checklist

Immediate actions (24-48 hours)
- [ ] Audit current SMS-based MFA implementations and identify replacement timeline
- [ ] Configure authentication system logging to capture mobile user agent strings and timing data
- [ ] Establish baseline correlation between inbound SMS delivery and subsequent authentication events
- [ ] Review employee directory publications and remove unnecessary phone number exposure

Short-term implementation (1-2 weeks)
- [ ] Assess whether enterprise SMS gateway capabilities are available through your carrier or messaging platform and evaluate filtering policy options
- [ ] Configure MDM policies to restrict browser access to newly registered domains
- [ ] Implement authentication monitoring for mobile device access patterns
- [ ] Establish incident response procedures for suspected smishing compromise

Medium-term hardening (1-3 months)
- [ ] Replace SMS-based MFA with authenticator applications or hardware tokens, consistent with NIST SP 800-63B guidance
- [ ] Deploy domain monitoring for corporate lookalike domains
- [ ] Implement user training focused on SMS-based credential requests
- [ ] Establish communication policies prohibiting IT support via SMS

Ongoing operations
- [ ] Monitor correlation patterns between inbound SMS activity and authentication events
- [ ] Review and update suspicious domain blocking lists
- [ ] Validate SMS gateway filtering effectiveness through penetration testing
- [ ] Assess mobile device compliance with corporate authentication policies

Sources