To the puzzled: 'Smishing' = 'SMS' ∩ 'phishing'<p>> <i>Signs that you are getting "Smished": [...] when you receive a message from bigger service providers, (f.e. banks, post offices, or delivery services) they will mostly have their company names displayed instead of their numbers</i><p>The formulation in the article may lead to a very bad advice: in some areas, scammers do display a "company name", regularly. So: a numeric sender string increases the chances of the SMS being a scam; an alphanumeric sender string /<i>does not</i>/ decrease the chances of the SMS being a scam.
> As software capable of zero-click exploit, Pegasus requires no user interaction to operate: ... As a result of a simple click on the URL, the spyware was granted unlimited access to every information stored on the iPhone.<p>That's a one-click exploit, no?<p>Pegasus has demonstrated zero-click exploits (e.g. PDF embedded in GIF), but this is not one.<p>edit: the provided CitizenLab link [0] describes two classes of attacks, "zero-click exploits and malicious SMSes". Looks like the author conflated the two?<p>[0] <a href="https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" rel="nofollow">https://citizenlab.ca/2022/04/catalangate-extensive-mercenar...</a>
> The number of the sender and that of the service provider they claim to be, do not match.<p>Don't forget that the caller ID here can be spoofed. It's best to disregard it completely.<p>One of the infographics in the article suggests looking up the number of the text, which I'd suggest is actively harmful advice - it gives you zero information and risks lulling people into a false sense of security. Assume that all texts are from scammers and act accordingly.
It would be great if a section about BEC [0] was included. At $WORK we see a lot of "Smishes" that pretend to be our CEO/CTO that ask for the user to send them money. E.g. "Hello it's $CEO, I'm in a meeting currently and need your help. Can you send me 300 dollars in apple gift cards?"<p>[0] <a href="https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise" rel="nofollow">https://www.fbi.gov/scams-and-safety/common-scams-and-crimes...</a>
> In many cases, simply clicking the provided link can initiate a download process of viruses or malware<p>I imagine some payloads use JavaScript to infect a device upon clicking. They probably target Chrome, or god forbid the Samsung Internet browser. If you wanted to see the payload, just open the link in a secure sandbox environment and view the source. Congratulations to them, they just allowed you to see their 0day in the wild, and it's no longer a 0day.
A good read, <a href="https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" rel="nofollow">https://citizenlab.ca/2022/04/catalangate-extensive-mercenar...</a>