T-Mobile staff receiving cash offers to help with SIM swap attacks

T-Mobile employees are being propositioned via text messages to partake in illegal SIM swapping activities, with a financial incentive of $300 per swap.

SIM swap attacks take advantage of consumers using SMS as their two-factor authentication (2FA) method. By transferring a number via a SIM swap, an attacker can gain unauthorised access to victims’ accounts.

This phenomenon of SIM swapping is a severe concern since it compromises the integrity of what is otherwise a trusted method of securing online accounts, including banking and cryptocurrency wallets. Consumers are recommended to use alternative 2FA methods, such as apps like Authy or hardware keys like Yubico, to avoid SIM swap attacks.

The source of these propositions to T-Mobile staff appears to be exploiting personal information to solicit employees directly, with communications sent from a diverse array of phone numbers to evade blocking measures. Workers are being contacted with offers of monetary compensation in exchange for their cooperation in swapping SIM cards, a request facilitated through a prompt to communicate further on the encrypted Telegram messaging app.

These unsolicited texts assert that the sender has obtained the recipient’s contact details from the “T-Mo employee directory,” signalling a significant breach of confidential information:

There is speculation surrounding the origin of this data, particularly whether it is being continually accessed or if it was obtained from a previous security breach. The fact that some of the affected individuals are no longer employed with T-Mobile, having left the company months ago, suggests that the compromised information could be somewhat dated.

This incident raises serious questions regarding the security of employee data and the mechanisms in place to protect such information. While the specific source of the leaked employee phone numbers remains uncertain, the implications of this breach are clear, posing a tangible threat not only to the employees targeted by these offers but also to the broader base of T-Mobile customers potentially affected by the facilitated SIM swap attacks.

As investigations continue into the origins of the compromised employee directory and the extent of its unauthorised access, this incident serves as a reminder of the vulnerabilities inherent in digital communications and the constant vigilance required to protect against malevolent actors seeking to exploit those vulnerabilities for financial gain.

(Photo by Andrey Metelev)

See also: French municipal services disrupted by cyberattack

Unified Communications is a two-day event taking place in California, London, and Amsterdam that delves into the future of workplace collaboration in a digital world. The comprehensive event is co-located with Digital Transformation Week, IoT Tech Expo, Edge Computing Expo, Intelligent Automation, AI & Big Data Expo, and Cyber Security & Cloud Expo.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.

Tags: 2fa, attack, cyber security, cybersecurity, hacking, infosec, sim swap, t-mobile, telecoms, two factor authentication