The Rise of OTP Bots and SMS Senders in the Arsenal of Threat Actors

This report analyzes the SpoofMyAss underground service that offers OTP-extraction (vishing) bots, global SMS-sending, caller-ID spoofing, SSML voice templates, number-generation/validation and private SMS gateways; it documents how these tools enable large-scale social-engineering campaigns, account takeover, financial fraud and harassment, and cites real-world abuse such as the Scattered Spider–linked MGM Resorts breach to illustrate impact.