This campaign involves smishing attacks where threat actors send fraudulent text messages impersonating T-Mobile, warning recipients that their rewards points (commonly cited as 18,400 points) will expire soon. The messages contain links to phishing websites hosted on numerous rotating domains designed to look like official T-Mobile sites. The attackers use generic greetings and formal language to appear credible and employ social engineering to steal sensitive information. The campaign generated over 1,000 closely related message templates and operated with at least 81 domains over a four-month period, with two notable spikes in activity.

Recipients of these phishing SMS messages risk divulging sensitive information such as login credentials, personal details, or payment information to attackers. This can lead to account compromise, financial loss, and identity theft. The campaign's scale and use of numerous domains increase the likelihood of victim exposure.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Users should be advised not to click on links in unsolicited messages claiming urgent rewards expiration and to verify communications directly with T-Mobile through official channels. Organizations should raise awareness about this smishing campaign and encourage users to report suspicious messages. Blocking known malicious domains and employing SMS filtering solutions may help reduce exposure.