Open Nav
Sign Up

Under the hood of a Smishing campaign

Under the hood of a smishing campaign

Dan Shallom

May 7, 2022

Earlier today our OP Innovate research team received yet another Smishing attempt asking them to provide credit card details. 

The SMS looks like a legitimate message from the Israeli post offices and even contains a correctly formatted tracking number:

החבילה שלך: RU0041902037Z‌ מוכן לאיסוף, אנא לחץ על הקישור והשלם את התשלום: https://2u.pw/MT5To

The message requests credit card details in order to pay customs fees associated with a package and enable its delivery – this plays on the victim’s sense of urgency.

The Tiny URL service is legitimate and has been seen in previous phishing campaigns targeting Israelis.

When a victim clicks on the Tiny URL link they are redirected to the following website: https://cobbjones.ca/postal/log/app/

By navigating to the top level of the website, we arrive at the commercial and seemingly legitimate website of a Canadian law firm. The site must have been hacked in order to gain access to the sub folders – we approached the owner and informed them about the unfortunate hijacking of their web resources.

Hacked website

In terms of security, the site suffers from additional misconfigurations. These provide access to server logs and from there we could see the amount of traffic this site received, and of course the clear text credit card details that the victims inserted.

Here are some further insights:

This is how it looks like from an attacker perspective:

  1. The user form:
  2. The visitors logs
  3. The detailed visitors logs – post processing

Here are some of our insights into the attack:

  1. 06-May-2022 10:43:15 first hit – this is most probably the attacker testing their tools
  2. 07-May-2022 10:40:22 last hit; – this is most probably the tiny URL provider responded
  3. The number of SMS sent / received is unknown
  4. 4103 victims who received the SMS opened it, clicked the link and got to the phishing website
  5. 257 victims of them moved forward and provided credit card data:
    1. 164 were legitimate details
      1. 119 Visa card
      2. 45 Mastercard 
  6. As can seen from the chart below, the campaign was most successful during its first 5 hours:

We took the following action with this information:

  1. Reported the attack to the Israeli CERT 
  2. Reported the attack to the Israeli credit cards companies so that they can approach the victims 
  3. Approached the Tiny URL provider who killed the campaign 
  4. Approached the hacked website owner with some recommendations for patching and recovery
  5. Posted this blog and spread the word – if you happen to clicked and provided your card details contact your credit card provider immediately

Have a safe weekend! 

OP Innovate

Resources highlights

Critical Cisco ISE Vulnerabilities Lead to Unauthenticated RCE (CVE-2025-20281 & CVE-2025-20282)

On June 25, 2025, Cisco disclosed and patched two critical remote code execution (RCE) vulnerabilities: CVE-2025-20281 and CVE-2025-20282, affecting its widely deployed Identity Services Engine…

Read more >

CVE-2025-20281 & CVE-2025-20282

Critical Vulnerability in MegaRAC BMC Added to CISA’s KEV: CVE-2024-54085

On June 25, 2025, CISA added CVE‑2024‑54085, a critical authentication bypass vulnerability in the MegaRAC SPx Baseboard Management Controller (BMC) firmware, to its Known Exploited…

Read more >

CVE-2024-54085

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding a sophisticated malware campaign dubbed “UMBRELLA…

Read more >

umbrella stand fortinet

CVE-2025-49144: Privilege Escalation in Notepad++ Installer Enables Full SYSTEM Access

A critical local privilege escalation vulnerability in the Notepad++ v8.8.1 installer allows attackers to escalate to NT AUTHORITY\SYSTEM using binary planting techniques. Tracked as CVE-2025-49144,…

Read more >

CVE-2025-49144

Our Red Team’s Favorite Penetration Testing Tools in 2025 (And How We Use Them)

When it comes to red team operations, the tools you choose can make or break the engagement. From initial reconnaissance to post-exploitation, having a streamlined,…

Read more >

pentesting tools - op

New Linux Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Enable Full Root Access in Seconds

Security researchers have uncovered a critical privilege escalation chain in major Linux distributions that allows any local user with a session (SSH or GUI) to…

Read more >

CVE-2025-6018, CVE-2025-6019
Under Cyber Attack?

Fill out the form and we will contact you immediately.