SMS & OTP Bombing

This CRIL report analyzes a persistent, evolving ecosystem of SMS/OTP and voice-bombing tools and services (repository and web-based) active through 2025–2026, documenting ~20 actively maintained repositories and ~843 vulnerable authentication endpoints across multiple industries and regions (notably Iran and India). The research highlights increased sophistication — Go-based high-performance tools, Electron GUIs, Telegram bot interfaces, widespread evasion (75% SSL bypass, User‑Agent randomization), proxy usage, and commercialization of web services — and provides prioritized mitigations (rate limiting, dynamic CAPTCHA, TLS enforcement) to reduce attack impact.