Wide-scale, opportunistic SMS pumping attacks target customer sign-up pages

Okta Threat Intelligence identifies a cluster designated O-UNC-036 — shared disposable email domains and commodity proxy services — being used since at least March 2024 and observed in large-scale, financially motivated SMS-pumping campaigns starting by July 2025. Attackers create accounts with disposable email addresses, add attacker-controlled phone numbers, and send high volumes of messages to inflate telephony bills, causing financial loss and potential service degradation; the report urges immediate protective controls, monitoring, and aggressive response.