Phishing Campaigns Exploit RCS and iMessage to Evade SMS Security Filters

Phishing campaigns are entering a new phase as attackers abandon traditional SMS delivery and static credential theft in favor of encrypted messaging channels and real-time account takeover techniques.

Unlike conventional SMS phishing, RCS and iMessage operate over data networks with end-to-end encryption, limiting carriers’ ability to inspect or block malicious content.

Threat actors are exploiting this gap by delivering phishing links through these platforms, where messages appear more legitimate due to enhanced features such as read receipts, media support, and branded content.

This evolution allows attackers to craft convincing lures that mimic trusted services, including financial institutions, e-commerce platforms, and digital wallets. Because these channels are widely trusted by users, victims are more likely to engage with malicious links, unknowingly initiating credential theft workflows.

A defining feature of this new PhaaS ecosystem is the transition from static phishing pages to live interaction models. Once a victim submits login credentials, the data is instantly relayed to an attacker-controlled panel.

The attacker then triggers a legitimate one-time passcode (OTP) request and tricks the victim into entering it on the phishing page.

This real-time interception enables attackers to bypass multi-factor authentication (MFA) within seconds. Rather than simply stealing credentials, threat actors are increasingly focused on capturing session tokens or provisioning payment cards into attacker-controlled digital wallets.

According to Google Threat Intelligence Group (GTIG), a rapidly expanding Chinese-language phishing-as-a-service (PhaaS) ecosystem is now leveraging Rich Communication Services (RCS) and Apple iMessage to bypass telecom-level security filtering, significantly increasing the success rate of social engineering attacks.

This process converts stolen card details into tokenized assets that can be used for contactless payments or high-value transactions.

Phishing Campaigns Exploit RCS and iMessage

GTIG’s analysis highlights that PhaaS platforms are not just replicas of Russian-speaking cybercrime services but represent a distinct and mature ecosystem.

These services are openly advertised on Telegram and often bundle additional criminal offerings, including stolen data sales, VPS hosting, domain registration, and money laundering support.

Notably, these campaigns tend to target users outside China, with a strong focus on regions such as Japan, Europe, and North America. Platforms like YY Lai Yu demonstrate advanced localization capabilities, offering hundreds of phishing templates tailored to specific countries, brands, and consumer behaviors.

For example, attackers targeting Japan have used localized lures involving loyalty point redemptions, utility subsidies, and popular services like PayPay and Rakuten. These culturally aware tactics significantly increase engagement and success rates.

Another major advancement is the integration of artificial intelligence into phishing operations. Platforms such as Darcula use AI-powered tools to dynamically generate phishing pages by cloning legitimate websites in real time.

By replicating HTML, CSS, and JavaScript from target URLs, attackers create unique pages that evade traditional signature-based detection systems.

Additionally, many phishing sites now include anti-bot mechanisms, such as manual verification steps, to prevent automated security scanning. This added layer of stealth makes detection and takedown efforts more challenging for defenders.

The rise of encrypted message-based phishing and real-time credential interception underscores the limitations of traditional defenses. User awareness alone is no longer sufficient against highly interactive and localized attack chains.

Security experts recommend adopting phishing-resistant authentication methods such as FIDO2 or WebAuthn, which eliminate reliance on OTPs. Financial institutions are also encouraged to implement device fingerprinting and risk-based verification during digital wallet provisioning to prevent unauthorized tokenization of payment cards.

As phishing infrastructure becomes more automated and globally scalable, defenders must shift focus from detection to prevention ensuring that even if credentials are compromised, they cannot be effectively exploited.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.