Topic
Phishing conducted via text message (smishing), often impersonating trusted brands or authorities to steal credentials or payment details.
Cyble says GhostBat RAT, spread by fake mParivahan and eChallan traffic-fine texts, now monitors 60 Indian banking, UPI and wallet apps for PINs. Its invisible-keypad overlay targets only Google Pay and MobiKwik.
Reality
BlueKit, a phishing-as-a-service kit Malwarebytes has tracked since April, runs lures for 97 brands in 176 variants from one dashboard. Its targets include corporate SSO gateways, Salesforce and GitHub, so buyers with little skill can aim polished lures at work accounts.
Reality
Scammers text people a fake Facebook Marketplace listing naming them as seller to provoke a 'that isn't me' reply, Malwarebytes reports. Any answer tells a sender who likely already has the name and number that the line is live.
Reality
Job lures arrive by email, romance by social media, tech support by phone, across three months of one vendor's telemetry. The counts measure delivery; conversion, where the training math gets harder, isn't part of what's tracked.
Reality
Malwarebytes has tracked the rewards-expiry smishing since early May 2026 and counted more than 1,000 template variants pointing at hostnames built as t-mobile plus six random letters under .top.
Reality
Group-IB says the phishing kit Google sued over in June kept producing pages after the FBI seized its admin servers and wallets, which puts the durable detection signal in the kit's file names rather than its hosts.
Reality