CALL 0121 289 4477
Our mobile devices are more than just communication tools; they’re central to everything from shopping and banking to connecting with friends and colleagues. Unfortunately, this reliance on smartphones has made them prime targets for cybercriminals, who are increasingly using tactics like smishing (SMS phishing) to exploit unsuspecting users. One alarming method that cybercriminals are using involves bypassing the iMessage built-in phishing protection feature by tricking users into re-enabling potentially dangerous links in text messages. Here’s how the scam works and what you can do to protect yourself.
To safeguard users from malicious attacks, Apple has implemented a feature in iMessage that automatically disables links in messages received from unknown senders—whether it’s a phone number or email address. This protection helps prevent malicious links from being activated and potentially harming your device.
However, recent reports indicate that cybercriminals have discovered a way to exploit this safety feature by manipulating users into re-enabling the links.
Cybercriminals are leveraging familiar SMS tactics to deceive users into turning off iMessage’s phishing protection. When you receive a message from an unknown sender—often disguised as a legitimate business like USPS or a traffic authority—the links in the message are automatically disabled. While these phishing attempts aren’t new, the key difference now is how the attackers are getting users to react.
Some of the phishing messages, such as fake USPS shipping issues or road toll violations, encourage recipients to reply with a simple “Y” to activate the links. Once a user responds, iMessage will enable the links again, effectively bypassing its phishing protection.
One example of this phishing scam reads:
“Please reply Y, then exit the text message, reopen the text message activation link, or copy the link to Safari browser to open it.”
By asking the user to reply with a simple action, the attackers are hoping to trick the recipient into thinking they need to confirm something, like an appointment or a shipping issue. In reality, their response enables the dangerous link and gives the attacker more information about the user, such as the fact that they engage with phishing messages.
The success of this lies in its simplicity. Many people are accustomed to responding to text messages with simple “Y” (yes) or “STOP” replies for various services. Cybercriminals know this, and by mimicking common practices, they increase the likelihood of someone responding to their message and unknowingly disabling iMessage’s phishing protection.
Even if the user doesn’t click on the now-active link, replying to the message signals to the attacker that the user is engaging with the message. This could lead to further attacks, as the attacker now knows they have an active target.
This scam has seen a significant rise over the past several months, particularly since the summer of 2024. Although tech-savvy users may recognize these scams for what they are, others—such as elderly users or those less familiar with phishing tactics—are often unaware of the danger. These individuals are prime targets for attackers, who may steal sensitive information like credit card details, passwords, or personal identification.
If you receive a message from an unknown number with disabled links, do not respond to the message. The best course of action is to contact the organization directly through a verified phone number or official website to confirm whether the message is legitimate. Avoid interacting with the text in any way.
If you’re ever in doubt about a suspicious message, remember: legitimate companies will never ask you to reply to texts to activate links or provide personal details. Always stay cautious and verify before taking action.
In a business environment scenario, the same applies. Do not respond. Instead, contact your relevant IT Department and report it.
By being aware of how attackers use iMessage’s phishing protection against you, you can better protect yourself and your personal information from falling into the wrong hands. Stay safe, stay cautious, and remember: if in doubt, don’t click and don’t reply.
We hope you’ve enjoyed this blog! We cover everything from IT News to Cyber Security articles like this, feel free to check them out.