Attack type
Credential harvesting, caught before the click.
Fake MFA prompts, IT-help-desk lures, and login spoofs increasingly arrive in SMS — because that’s where the click-through rate is highest and the SOC visibility is lowest.
What we see in the wild
The patterns landing on your employees’ phones.
“Your Microsoft password expires in 24 hours — verify here”
Fake Okta, Duo, and Microsoft Authenticator reset flows
IT-help-desk impersonation timed to coincide with real ticket activity
Look-alike domains hosted on legitimate cloud infrastructure
Why traditional tools miss it
SEGs do not see SMS. Endpoint EDR doesn’t fire until the user has already entered credentials. By the time the suspicious login is detected, the session has been hijacked.
How SmishAlert surfaces it
On-device classification of credential-harvesting patterns. Optional Apple network defer for URL verification when policy enables it. Reports correlated against known phishing infrastructure.
What this looks like in a 30-day window.
Microsoft, Okta, and Duo lures led the sample window.
FAQ
Questions security leaders ask
How is SMS credential harvesting different from email phishing?
SMS credential lures land in a channel your secure email gateway can’t see, and they convert at a higher rate because messaging feels personal and urgent. SmishAlert classifies these patterns on-device and correlates them against known phishing infrastructure so the SOC gets the signal it never had.
Can SmishAlert detect fake MFA and password-reset texts?
Yes. SmishAlert flags fake MFA prompts, Okta/Duo/Microsoft reset flows, and IT-help-desk impersonation on the device, before the employee clicks. With policy enabled, an optional Apple network defer supports URL verification.
Why doesn’t EDR catch credential harvesting from text messages?
Endpoint detection fires after a user has already entered credentials and a session is being used. SmishAlert moves detection earlier — to the moment the lure is received and reported on the phone.
How do I quantify credential-harvesting risk across my workforce?
A SmishAlert 30-day exposure pilot captures every reported credential lure across 25–100 enrolled users and reports attempts, spoofed brands, and the look-alike domains involved.
Measure it
See it running against your workforce.
A 30-minute scoping call. A 30-day pilot. A report your CEO will read.
Or take the 2-minute self-evaluation — no email required.