Hackers Use Cellular Router API to Send Malicious SMS with Weaponized Links

Hackers are abusing the API of Milesight industrial cellular routers to push smishing campaigns that deliver phishing URLs via malicious SMS messages. According to Sekoia[.]io’s Threat Detection & Research (TDR) team, suspicious traces appeared on 22 July 2025, with the operation targeting Belgium and impersonating services such as CSAM and eBox while using the +32 country code.

Logs from honeypots showed unauthenticated POST requests to the /cgi endpoint containing parameters like query_outbox or query_inbox, enabling attackers to send messages or retrieve inbox data without authentication. A Shodan search identified over 19,000 Milesight routers exposed on the public internet, with 572 of 6,643 checked devices allowing unauthenticated API access and many running outdated firmware.

Campaigns clustered by region have included Dutch or French messages aimed at Belgian numbers, and smishing activity dates back to February 2022, with thousands of messages sent to tens of thousands of numbers in Sweden, Italy, Belgium, and France. This underscores how vulnerable, internet-facing cellular routers can be weaponised to distribute SMS phishing at scale.