Hackers Exploit Cellular Router’s API to Send Malicious SMS Messages With Weaponized Links
Recently, a vulnerability in the web-based management interfaces of certain cellular routers has been exploited by attackers to misuse their SMS functionality.
Recently, a vulnerability in the web-based management interfaces of certain cellular routers has been exploited by attackers to misuse their SMS functionality.
By targeting exposed APIs, attackers can send large volumes of malicious SMS messages containing links to drive-by downloads or credential-stealing pages.
This threat vector exploits legitimate network equipment, transforming routers into proxies for mass phishing campaigns and malware distribution.
Victims receive SMS texts that appear to be security alerts or delivery notifications, but clicking the URL can exploit device vulnerabilities or launch social-engineering traps.
In August and September 2025, security operations centers reported unusual spikes in SMS traffic originating from routers rather than cellular networks.
Researchers identified that threat actors were scanning for endpoints exposing vendor APIs, especially on models using TR-064 or custom HTTP-based SMS interfaces. Source
These interfaces allow unauthenticated or weakly authenticated commands to send arbitrary SMS messages via the router's SIM card.
Common issues include unchanged default credentials and outdated firmware lacking API rate-limiting or input validation.
By targeting exposed APIs, attackers can send large volumes of malicious SMS messages containing links to drive-by downloads or credential-stealing pages.
Network administrators often do not monitor SMS logs on routers as rigorously as network traffic, allowing large-scale campaigns to go unnoticed.
Initial messages masquerade as two-factor authentication requests or urgent account recovery notifications, exploiting user trust. Subsequent campaigns use targeted bait based on harvested data.
Successful exploitation can deliver secondary payloads, such as a backdoor, granting attackers persistent access.
In corporate environments, this can facilitate lateral movement, data exfiltration, or enrolling additional devices into the SMS-spam network, amplifying reconnaissance and monetization opportunities. Source
The campaign abuses the router's SMS API endpoint. Attackers gain access by brute-forcing or enumerating default administrative credentials.
With valid access, they issue HTTP requests mimicking legitimate SMS-sending commands:
curl -X POST http://192.168.1.1/api/sms/send \ -H "Content-Type: application/json" \ -d '{ "username":"admin", "password":"admin123", "destination":"+15551234567", "message":"Your account requires immediate verification: http://bit.ly/verify-now" }'
The API often lacks strong input sanitization, allowing HTML or JavaScript injection in the message payload.
The SMS API exposes status codes and delivery reports, which attackers use to measure campaign success and optimize targeting.
Threat actors have repurposed routers into distributed SMS-spam bots, using scripts to cycle through recipient lists, randomize sender IDs, and rotate message templates.
Defenders can mitigate this threat by enforcing strong administrative credentials, disabling unused SMS interfaces, and applying firmware updates with proper authentication controls.
Proactive SMS-traffic monitoring can also help disrupt this stealthy threat.
Based on reporting by Cyber Security News.