Fake CAPTCHA SMS Fraud and SMS Blaster Smishing Target Mobile Users

Infoblox researchers reported a long-running International Revenue Share Fraud (IRSF) campaign that uses fake CAPTCHA pages to trick mobile users into sending premium-rate international text messages. Victims are funneled through typosquatted telecom-themed domains, ad-network redirects, and Traffic Distribution System (TDS) infrastructure to scam landing pages that present bogus verification steps. Those prompts trigger JavaScript that opens the phone’s SMS app with pre-filled messages and dozens of international numbers, and a single four-step interaction can generate about 60 SMS messages to more than 50 destinations, costing roughly $30 or more per session. Researchers said the operation has been active since at least 2020, uses high-fee destinations including Azerbaijan, Egypt, and Myanmar, and has been linked to an affiliate of a European Click2SMS network using infrastructure hosted on AS15699, Adam Ecotech.

Separately, Toronto police arrested three men in what authorities described as Canada’s first criminal case involving a mobile SMS blaster, a rogue device that impersonates a cellular tower to push phishing texts and disrupt legitimate service. Investigators said the devices were tracked across the Greater Toronto Area after one was detected in downtown Toronto, and police seized multiple SMS blasters and related equipment. Authorities believe tens of thousands of phones connected to the rogue system, contributing to more than 13 million network disruptions that may have interfered with normal mobile access and even emergency services such as 911. The cases highlight how attackers are abusing both web lures and fake base-station hardware to scale smishing and mobile billing fraud.