Last month, we covered a new SMS phishing scam specifically targeting iPhone users. The idea behind the scheme is to trick the recipient into replying to a text in order to activate a link, which would then be clicked, either purposefully or inadvertently, and activate a piece of malware.
Messages in iOS 18 has a feature that turns off hyperlinks when receiving a text from a number that’s not in your Contacts list. That extra bit of security makes it difficult for scammers to trick you into clicking their links—unless you then reply, which unlocks the link.
The idea is that the original text tricks you into replying with something as simple as a Y or N so the link will become clickable. It’s usually a question or some kind of opt-out trick to get you to respond. But the one I received on Thursday was neither clever nor tricky.
The first tip-off was the sender’s name, which was too long to even display on the screen: hanwen.zhanyi.1991_zhongweicong-yulunchui@musician.org. The second clue was the message text, which told me my car had an unpaid toll and asked me to “settle properly” to avoid “excessive late fees.”
Foundry
After all that scary text was a web address without a hyperlink because the number was unknown. Instead of trying to trick me into responding, however, the rest of the message read: “Please reply Y, then exit the SMS and reopen to activate the link, or copy the link to your Safari browser and open it.”
That’s about as obvious as a smishing attempt can get. I suppose it’s possible that an unsuspecting user could unwittingly follow those instructions and open their phone to malware, but mostly it’s just an advertisement for Apple’s excellent security measures to prevent attacks before they can even start.
So sorry, hanwen.zhanyi.1991_zhongweicong-yulunchui@musician.org, maybe next time try an Android user.
