Thousands of Apple iOS Users Smished... Again

There’s a new term in town and it refers to phishing via text messaging. That word, which is likely to come up more frequently going forward, is called “smishing.” Mobile phishing is one of the trends that security experts believe is going to ramp up quickly, and the latest effort is targeting Apple’s iOS users. More than 7,500 of them were compromised in a recent malicious attack.

Essentially a cyber criminal just takes a phishing email message and repurposes it in a text message format. Sometimes, they don’t even bother to change the format, so it looks like you’re getting email in your text message window. However, as in phishing email, they often include malicious links in a shortened format so that it appears to be legitimate. If it’s clicked, users are directed to a webpage stating they must verify banking, email information, or e-commerce account details or they will get locked out of their accounts.

Don’t panic if you ever receive such a message in text or even via another chat program such as WhatsApp. Use the same logic as you would with any other information that you receive in email. If it’s really that important, they will call you on the phone. To check on the legitimacy, go directly into your account by either typing in the name of the site manually, being careful not to make typos. You can also click a previously bookmarked link that you know is the correct one. Never click links sent in text messages that you are not expecting whether you know the sender or not, or those that come from unfamiliar numbers. Use the same guidelines you would use to determine if an email message is phishing.

It’s not clear how many of the 7,500 in this scenario actually fell for it completely. However, if the link is clicked the site the user sees is a very good copy of the Apple verification page. If you need to verify your Apple account details, log into your account separately rather than clicking a link in any type of message. If you think any of your information may have been compromised, change the passwords to those accounts.

SMS messages are not monitored or governed in the same, stricter way as the App Store or the operating system (iOS) platform itself, and the cybercrime world knows it. Therefore, expect to see these types of attacks more and more. If everyone learns how to recognize them and fewer and fewer fall for them, then fewer and fewer cyber criminals will use this method to acquire sensitive information. It’s your information. Keep it safe with you and out of their hands.