U.K. Arrest in ‘SMS Bandits’ Phishing Service
Summary: U.K. authorities arrested a 20-year-old man from Birmingham for allegedly running "SMS Bandits," a service that sent high-volume SMS phishing lures spoofing COVID-19 relief efforts, PayPal, telecom providers and tax agencies. Scylla Intel, which researched the operation before the arrest, said the group's native-English lures were better written than most, while its opsec was poor enough to identify members in real life.
Key Takeaway: The same operation ran an "auto-shop" panel reselling working credentials from PayPal, banks and utilities, and was tied to OTP Agency, a service charging $40 to $125 per week to call victims and harvest one-time passwords in real time. SMS phishing volume rose more than 328 percent in 2020, per Proofpoint, so the arrest removes one supplier while the delivery model and its OTP relay remain available to others.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026