Named a Visionary in Gartner Magic Quadrant for Secure Web Gateways (SWG)
Our platform invisibly protects users wherever they go online. So threats are history and the alert storm is over.
Traditional network security wasn’t built to address today’s complex enterprise environments. SASE fixes that problem.
Menlo Labs provides insights, expertise, context and tools to aid customers on their journey to connect, communicate and collaborate securely without compromise. The collective is made up of elite security researchers that put a spotlight on the threats you know and don’t know about.
Menlo Labs provides insights, expertise, context and tools to aid customers on their journey to connect, communicate and collaborate securely without compromise.
Share this article
Earlier this month, mobile users began being targeted with smishing messages in what appears to be an organized spam operation campaign. Smishing is much like phishing, except rather than sending email, the attackers send text messages using SMS (Short Message Service). The smishing campaign has been sending fake United States Postal Service (USPS) or FedEx shipment updates as well as phony Amazon loyalty program rewards via text messages.
In this blog, we’ll focus on the risk of visiting such links from a mobile device, and why mobile devices should be considered for a Zero Trust architecture. Zero Trust assumes that all web content is harmful and prevents any website from running code on your users’ devices. This approach protects users from untrusted actors without inhibiting users’ ability to do work.
This smishing campaign seems to be device agnostic. Using redirection mechanisms, the campaign serves different landing pages, depending on the client browser and device:
The final landing page links used to serve the fake content are generated only once. Visiting these links offline or trying to replay them results in an HTTP 404 error.
The following image shows the different landing page themes based on the client device:
Although the smishing campaign has targeted both desktop and mobile device users, the focus seems to be on targeting mobile users with fake shipment updates from postal carriers, including USPS, FedEx, and UPS. The users are taken to a landing page where they’re prompted to provide credit card details along with other personal information.
The following table shows the cloud providers being used to host domains in the different stages of the campaign:
HTTPS (Let’s Encrypt Certs)
HTTP/HTTPS (Let’s Encrypt)
URLs are used in smishing attacks. The lifespan of these URLs is typically very short and categorized as “Unknown.” If the URL is not accessed within a short period of time, the domain disappears or the link returns an HTTP 404 error message.
Considering the above points, it takes a longer time for URL categorization and detection vendors to catch up. This type of categorization delay is often referred to using the term “Green to Red,” meaning a URL was categorized as benign or unknown at click time (GREEN), but became malicious or spam at a later time (RED).
Google Safe Browsing (GSB) also had a very poor detection ratio for the initial URLs and landing page URLs. While we were not able to check every URL against GSB, random sampling found five landing page URLs and five initial URLs that were not flagged as unsafe.
Initial URL Domain IPs (hosted on .com/.info TLDs):
Sample Initial Link URLs (Mobile):
Landing Page IPs (hosted on .best / .today TLDs):
Sample Landing Page URLs (Desktop):
Sample Landing Page URLs (Mobile):
With the surge in remote work in the last year, we’re seeing growth in both mobile smishing and phishing attacks. People are more likely to be using their personal devices for work. Not being on the corporate network may also make people more vulnerable. Mobile devices and browsers are an enticing target for cyberattackers looking to exploit zero days and conduct socially engineered phishing attacks. In many organizations, however, mobile security is treated as an afterthought. To help combat these attacks, we recommend that companies look into deploying a mobile browser isolation solution—one that’s designed to eliminate the threat of smishing, phishing, and malware attacks when users are accessing the Internet and email from their smartphones and tablets.
Tips for Protecting Your Company and Users from Smishing
Menlo Labs provides insights, expertise, context, and tools to aid customers on their journey to connect, communicate and collaborate securely without compromise. Learn more about this elite collective and their work in the Isolation Security Operations Center
Krishnan Subramanian on Apr 29, 2021
To talk to a Menlo Security expert, complete the form, or call us at (650) 695-0695.