Smishing is a variant of phishing that uses text messages (SMS) or messaging apps to trick victims into opening a fake link, handing over data or installing malware. The name combines SMS and phishing. A common example is a message that impersonates a bank or a delivery company and asks the recipient to confirm a purchase or pay a fee for a held package.
How TecnetOne handles it: Security Awareness Training
SMS phishing, text message scam, smishing attack, smishing examples, mobile phishing
Related terms
Vishing
Vishing is a variant of phishing carried out by phone call or voicemail: the attacker poses as a bank, the IT help desk or an executive to obtain passwords, verification codes or a wire transfer. The name combines voice and phishing. Some attackers now use voices cloned with artificial intelligence (AI) to sound like someone the victim knows.
Prompt injection
Prompt injection is an attack against AI applications built on large language models (LLMs) that slips in malicious instructions so the model ignores its rules. It can be direct, typed by the user, or indirect, hidden in an email, document or web page the assistant processes, and it can lead to data leaks or unauthorized actions such as sending files or messages.
MFA fatigue
MFA fatigue is an attack in which someone who already has a victim's password sends repeated multi-factor authentication (MFA) approval requests to their phone until the person accepts one out of frustration or confusion. It is also called MFA bombing or push bombing. It is mitigated with number matching, attempt limits and phishing-resistant methods such as passkeys.
Double and triple extortion
Double extortion is a ransomware tactic in which attackers steal a copy of the data before encrypting it and threaten to publish it if the company does not pay. Triple extortion adds a third form of pressure, such as distributed denial-of-service (DDoS) attacks or direct messages to the victim's customers and partners. Backups alone do not remove the risk of a data leak.
Credential theft
Credential theft is the unauthorized capture of usernames, passwords, tokens or session cookies so an attacker can sign in to systems as a legitimate user. It happens through phishing, infostealer malware, keyloggers or breaches of other services. For example, a corporate email password entered on a fake login page can give access to Microsoft 365 without installing any malware.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.