Definition
Smishing, a portmanteau of SMS and phishing, is a type of social engineering attack that uses text messages to trick individuals into revealing sensitive information or downloading malicious software. Attackers send deceptive SMS messages that appear to be from legitimate sources, often urging the recipient to click a link, call a number, or reply with personal data. This tactic poses a significant risk in professional settings as it can lead to data breaches, financial loss, or unauthorized system access. For instance, an employee might receive a text claiming to be from HR about a payroll issue, prompting them to click a link that installs malware. Unlike email phishing, smishing leverages the immediacy and perceived trustworthiness of SMS communication, making it a distinct threat vector. Understanding smishing is crucial for cybersecurity certifications like CompTIA Security+ and CySA+.