This campaign is notable in that it demonstrates how impactful smishing operations can be executed using simple, accessible infrastructure. Given the strategic utility of such equipment, it is highly likely that similar devices are already being exploited in ongoing or future smishing campaigns. Sekoia said it's unclear how the devices are being compromised. One possibility is through CVE-2023-43261, a vulnerability in the routers that was fixed in 2023 with the release of version 35.3.0.7 of the device firmware.
These cybercriminals are no longer content with just sending you the odd phishing text or two. As Wired reports, more and more of them are using so-called "SMS blasters" that basically act as a portable cell tower, tricking your phones into connecting with them as they cruise by. The scammers walk or drive around with the devices, firing out a ludicrous volume of SMS messages that contain dangerous links.