Unraveling the U.S. toll road smishing scams
Summary: Since mid-October 2024, Cisco Talos has tracked smishing attacks impersonating U.S. toll road payment services such as E-ZPass, sending SMS messages to people in about eight states including Washington, Florida, Pennsylvania, Virginia, Texas, Ohio, Illinois and Kansas. The messages claim a bill under $5 with a threat of late fees, then route victims through a fake CAPTCHA to a spoofed page bearing the real toll service's logo, collect name, address, phone and credit card details, and show a fake bill of about $4 with a $35 late fee. Talos assesses with moderate confidence that multiple actors run the campaign using a smishing kit from a developer known as Wang Duo Yu, whose Telegram channel had more than 4,400 subscribers and who sells kits at $50 for full-feature development, $30 for proxy development, $20 for version updates and $20 for other support.
What you should know: The kit sells for as little as $30 to $50 and targets large public-facing entities with big user bases - toll operators, banks and postal services - so the barrier to running this against your customers is a few dozen dollars and a Telegram account.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026