Cisco Talos Blog: Unraveling the U.S. toll road smishing scams

Apr 10, 2025

—

Source URL: https://blog.talosintelligence.com/unraveling-the-us-toll-road-smishing-scams/
Source: Cisco Talos Blog
Title: Unraveling the U.S. toll road smishing scams

Feedly Summary: Cisco Talos has observed a widespread and ongoing financial theft SMS phishing (smishing) campaign since October 2024 that targets toll road users in the United States of America.

AI Summary and Description: Yes

Summary: The text details a widespread SMS phishing campaign (smishing) targeting U.S. toll road users, reportedly orchestrated by financially motivated threat actors using a developed smishing kit. This highlights the rising sophistication of phishing attacks, emphasizing the need for robust security measures to combat evolving threats.

Detailed Description:
The analysis describes a financial theft campaign through smishing that targets toll road users in several U.S. states. This campaign is reportedly operated by multiple threat actors utilizing a smishing kit known to be developed by an individual named “Wang Duo Yu”. The ongoing nature of these attacks signifies a worrying trend in cybercrime, where organized crime groups exploit digital platforms for malicious intent.

Key points include:

– **Toll Road Smishing Campaign**: Since October 2024, there has been an increase in smishing attacks impersonating toll road automatic payment services like E-ZPass, with nearly eight states affected.

– **Method of Operation**:
– Potential victims receive SMS notifications claiming an overdue payment, creating urgency to visit spoofed domains.
– Upon accessing the site, victims encounter a fake bill showcasing minimal balances and threats of late fees to encourage them to provide personal and financial information.

– **Use of Typosquatting**: Attackers utilized typosquatted domains (slight variations of legitimate web addresses) to divert victims to their fraudulent sites.

– **Stolen User Data**: The campaign may leverage user data from past leaks, although no concrete evidence links it to the large-scale 2024 National Public Data leak.

– **Phishing Infrastructure**: The actors are consistently registering new domains, demonstrating the continual evolution of their phishing tactics.

– **Resource and Kit Development**: The smishing kits used in the campaign are reportedly shared on platforms like Telegram, where the developer also offers tutorials and full support services.

– **Security Recommendations**:
– Cisco’s suite of security products, including Secure Endpoint, Secure Email, and Secure Access, can help mitigate these threats through malware detection and user authentication processes.

The text underscores the critical need for security professionals to stay vigilant against such evolving threats, implement comprehensive security measures, and conduct ongoing training for users to recognize and report potential phishing attempts. The proliferation of smishing kits highlights a shift in attack methods, driving home the importance of proactive defense strategies in cybersecurity.

2 2024 24 4 a access Act active defense AI alt analysis and Aria as attack attack method attack methods attackers attacks authentication Authentication Process authentication processes Auto by C CI CIA Cisco Cisco Talos co core crime critical cyber cybercrime cybersecurit Cybersecurity D data data leak de defense defense strategies demo detection developer development digital digital platforms domain domains Driving dual e email end endpoint evolving threats exp exploit fees financial financial information for fraud full g Gen GIS git Go Group H high Highlight HR http HTTPS in information infrastructure Intel intelligence intent ite k Key l large led Li life Link malicious intent malware malware detection measures mini multi N nation National Public Data no notifications o of off on operation OPM organized crime over phi phishing phishing attack Phishing Attacks phishing attempts phishing campaign phishing tactics platform platforms point potential pre proactive proactive defense proactive defense strategies process processes product products professionals public public data Q R rag rate RCE recommendations red report resource Ro robust security s Scale scam scams sec secure secure access security security measure security measures security products security professionals security recommendations service services SHA shift Sig smishing smishing scams source SSE state T tactics Tails Talos Telegram text the theft threat threat actor threat actors threats to Tor TP training typosquatting U.S. UI under United States up ups US use user user authentication user data Users uth V victims WAN Ware web Wi x