Tired of Unpaid Toll Texts? Blame the 'Smishing Triad'

According to Palo Alto Networks' Unit42, the Smishing Triad has expanded from niche iMessage scams to broader global campaigns that impersonate government agencies and toll services. A large-scale smishing operation has been impersonating international brands across critical services in worldwide attacks, with the group focusing its activity in the US since 2024.

Between 1 Jan 2024 and June 2025, researchers identified 136,933 root domains and 194,345 fully qualified domain names registered by the Triad, with tens of thousands more FQDNs added since the blog’s data cut in June. The group has diversified its infrastructure, cycling domains rapidly and increasingly using prefixes such as gov-, sim-, dmv- and safety- to impersonate state and transportation-related entities.

The attack ecosystem also shows signs of evolving domain naming patterns to evade takedowns, aided by phishing-as-a-service kits and embedded AI features to streamline new campaigns. Smishing remains highly effective because texts are often trusted more than emails, prompting users to click through malicious links.