What Is Smishing and How Organizations Can Protect Themselves

This report describes smishing (SMS phishing) as a prevalent social-engineering TTP, highlighting a 2022 Twilio-related incident in which tailored fraudulent messages and a malicious URL led to credential theft and the compromise of 130+ connected organizations; it explains attack flow, common lures and targets, potential outcomes (credential theft, malware installation, ransomware and BEC follow-on attacks), and emphasizes the broad organizational risk posed by mobile-based social engineering.