<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-smishing-attacks
description: >-
  Detect and analyze SMS phishing (smishing) attacks targeting mobile users.
  Covers SMS content analysis, sender ID spoofing detection, short URL
  expansion, mobile threat defense integration, and carrier-level filtering.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - smishing
  - sms-phishing
  - mobile-security
  - sms-analysis
  - mobile-threat-defense
  - short-urls
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Detecting Smishing Attacks

## Overview

Smishing (SMS phishing) exploits the inherent trust users place in text messages
and the limited URL preview capabilities of mobile devices. This skill covers
SMS content analysis, sender ID spoofing detection, short URL expansion and
analysis, mobile threat defense integration, and organizational response
procedures for smishing campaigns.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `requests` | `pip install requests` |
| Mobile Device Management | Intune, Jamf, or similar |
| SMS gateway logs | Carrier or MDM telemetry |

## Key Concepts

### Smishing Attack Patterns

```
Common Smishing Pretexts:
├── Package Delivery
│   ├── "Your package is held at customs — verify: [link]"
│   └── Impersonates USPS, FedEx, UPS, DHL
├── Banking / Financial
│   ├── "Unusual activity on your account — verify: [link]"
│   └── Impersonates major banks, PayPal, Venmo
├── Government / Tax
│   ├── "IRS refund pending — claim now: [link]"
│   └── Impersonates IRS, SSA, DMV
├── Multi-Factor Authentication
│   ├── "Your verification code is 123456" (social engineering)
│   └── Designed to intercept real MFA codes
├── Employment
│   ├── "Job offer — apply here: [link]"
│   └── Targets job seekers with fake portals
└── IT Support
    ├── "Company IT: Update your password at [link]"
    └── Targets employees via personal mobile numbers
```

### Smishing vs. Email Phishing

| Factor | Smishing | Email Phishing |
|---|---|---|
| User trust | Higher (SMS feels personal) | Lower (spam awareness) |
| URL inspection | Minimal (mobile preview) | Moderate (hover preview) |
| Authentication | No SPF/DKIM/DMARC equivalent | SPF/DKIM/DMARC available |
| Gateway filtering | Limited | Mature |
| Sender spoofing | Easy (sender ID spoofing) | Detectable via headers |
| Link clicking rate | 2-5x higher than email | Baseline |

### Detection Challenges

```
Why smishing is harder to detect:
├── No equivalent to email authentication (SPF/DKIM/DMARC)
├── Sender ID can be easily spoofed via SMS gateways
├── Short URLs hide destination (bit.ly, t.co, etc.)
├── Mobile browsers show minimal URL information
├── Personal devices outside corporate MDM control
├── Carrier-level filtering is inconsistent
└── Users expect legitimate SMS notifications (2FA, delivery)
```

## Workflow

### 1. SMS Content Analysis

```bash
# Analyze SMS message for smishing indicators
node agent.js analyze-sms --message "Your package is delayed. Track here: https://bit.ly/3xK9pQ2"

# Batch analyze SMS messages from logs
node agent.js batch-analyze /tmp/sms_reports.json
```

### 2. Short URL Expansion

```bash
# Expand short URL to reveal final destination
curl -sIL -o /dev/null -w '%{url_effective}' "https://bit.ly/example"

# Automated URL expansion and analysis
node agent.js expand-url "https://bit.ly/3xK9pQ2"
```

### 3. Sender Analysis

```bash
# Check sender number/ID reputation
node agent.js check-sender --number "+15551234567"

# Identify spoofed sender IDs
node agent.js detect-spoof --sender-id "BANKOFAM"
```

### 4. Organizational Response

```bash
# Generate smishing alert for employees
node agent.js generate-alert --campaign "fake-delivery" --brand "USPS"

# Report to carrier
node agent.js report-smishing --carrier verizon --number "+15551234567"
```

## Detection

```yaml
title: Smishing Attacks Detection
id: 89eb3320-e834-4b2f-8dee-6671875b2d8e
status: experimental
description: Detects suspicious activity related to detecting smishing attacks techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| SMS content analyzed | Urgency, financial, and brand keywords flagged |
| Short URLs expanded | Final destination identified |
| Sender ID checked | Spoofing indicators detected |
| MDM configured | Mobile threat defense policies active |
| User reporting enabled | Forward-to-7726 (SPAM) communicated |
| Carrier filtering active | Number reported and blocked |

## References

- [FTC Smishing Guidance](https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages)
- [CISA Mobile Security](https://www.cisa.gov/news-events/news/security-tip-st04-010)
- [GSMA Fraud Prevention](https://www.gsma.com/security/)
- [MITRE T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)
- [Forward SMS spam to 7726 (SPAM)](https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts)
