Hackers Exploit Milesight Routers to Send Phishing SMS to European Users

Unknown threat actors have abused Milesight industrial cellular routers to send phishing SMS messages as part of a smishing campaign targeting European users since at least February 2022, with SEKOIA stating that the attackers are exploiting the router’s API to dispatch malicious messages containing phishing URLs. The campaigns have focused on Sweden, Italy and Belgium, using typosquatted URLs that impersonate government platforms and various service providers.

Of the 18,000 routers of this type accessible on the public internet, about 572 are deemed potentially vulnerable because they expose the inbox/outbox APIs, with roughly half of the vulnerable devices located in Europe. SEKOIA notes that the API can retrieve both incoming and outgoing SMS messages, indicating active exploitation, and that some industrial routers expose SMS features without authentication.

The attackers are believed to be exploiting a now-patched information-disclosure flaw tied to CVE-2023-43261 (CVSS 7.5), disclosed two years ago, and some campaigns have used JavaScript to check if pages are opened from mobile devices to serve malicious content.

One campaign domain, jnsi[.]xyz, was used between January and April 2025 and shows code to hinder analysis, while Telegram activity via a GroozaBot is linked to an actor named “Gro_oza.” According to SEKOIA, these devices offer decentralised SMS distribution across multiple countries, complicating detection and takedown.