Researchers Show How Email-to-SMS Gateways Could Enable Spoofed Messages in Trusted Threads
Summary
Researchers found that flaws in email-to-SMS translation and message-client identity handling could place spoofed texts in trusted conversation threads under specific conditions. Carriers largely mitigated the issues before public release.
Key points
- Researchers from UC San Diego and Carnegie Mellon presented the findings at the IEEE Symposium on Security and Privacy in May 2026.
- The attacks exploited legacy email-to-SMS gateways, not carrier compromises, privileged telecom access, rogue base stations, or network interception.
- In some cases, gateways checked the visible email From header but derived the SMS sender from the SMTP envelope sender, creating an identity mismatch.
- Under vulnerable conditions, some Android clients could interpret crafted sender strings as phone-number-like identities; on iOS, cross-channel conversation association could obscure sender provenance.
- The researchers disclosed the findings to the carriers studied, which largely mitigated the vulnerabilities before the paper’s public release.
- The article advises treating SMS as a low-trust channel, using phishing-resistant authentication, and not assuming a message’s placement in a conversation proves its sender is authentic.
Article Details
- Attack Vectors
- Abuse of legacy email-to-SMS gateways to inject spoofed messages into mobile messaging threads under specific carrier, device, and messaging-client conditions.
- Mismatched identity handling between the visible email From header and the SMTP envelope sender could allow a sender identity to pass one check while influencing the SMS sender displayed to recipients.
- Under vulnerable parsing conditions, crafted sender strings could be interpreted as phone-number-like identities, making spoofed messages appear within trusted conversations.
- A spoofed message containing a phishing link could exploit trust in an existing conversation to encourage recipients to click.
- Defensive Notes
- Treat SMS as a low-trust notification channel, not as a high-assurance authentication factor.
- Educate employees that a message's placement in an existing thread does not prove the sender's authenticity.
- Prioritize phishing-resistant multifactor authentication, such as passkeys, FIDO2 keys, or certificate-based authentication.
- Keep mobile fleets patched and policy-compliant, and integrate device posture into zero-trust access decisions through centralized device management.
- The article reports that researchers disclosed their findings to the studied carriers and that carriers largely mitigated the vulnerabilities before public release.
MITRE ATT&CK
T1566.002 · Spearphishing LinkThe article describes spoofed SMS messages containing phishing links, delivered through email-to-SMS gateways and potentially placed in trusted conversation threads.T1656 · ImpersonationThe described attack forges sender identity so a malicious message can appear to come from a trusted sender in an existing conversation.
Vendors
JamfJamf's Security 360: Mobile Devices 2026 report found that one in four organizations reported having a user fall victim to a phishing link. This research highlights an additional dimension of that problem: attackers doT-Mobileusers send emails to addresses like <phone-number>@vtext.com (Verizon) or <phone-number>@tmomail.net (T-Mobile), which the gateway would translate into native SMS or MMS.Verizonand cellular messaging. These services let users send emails to addresses like <phone-number>@vtext.com (Verizon) or <phone-number>@tmomail.net (T-Mobile), which the gateway would translate into native SMS or MMS.
Products
Androidmessaging-client conditions, these spoofed messages could appear inside trusted conversation threads on Android and iOS devices. Under vulnerable conditions, Android messaging clients could interpret some craftediOSconditions, these spoofed messages could appear inside trusted conversation threads on Android and iOS devices. Under vulnerable conditions, Android messaging clients could interpret some crafted sender stringsJamf Management Frameworkweaknesses translate into real enterprise risk. For troubleshooting, many Apple admins find the Jamf Management Framework useful.