Cyble analyzes increasing OTP/SMS bombing ecosystems utilizing excessive‑pace APIs, SSL bypass, and cross‑platform automation.
RESEARCH DISCLAIMER:
This evaluation examines the latest and actively maintained repositories of OTP & SMS bombing instruments to grasp present assault capabilities and concentrating on patterns. All statistics symbolize noticed patterns inside our analysis pattern and must be interpreted as indicative tendencies fairly than definitive totals of the complete OTP bombing ecosystem. The risk panorama is constantly evolving with new instruments and repositories rising repeatedly.
Govt Abstract
Cyble Analysis and Intelligence Labs (CRIL) recognized sustained growth exercise surrounding SMS, OTP, and voice-bombing campaigns, with proof of technical evolution noticed by means of late 2025 and persevering with into 2026. Evaluation of a number of growth artifacts reveals progressive growth in regional concentrating on, automation sophistication, and assault vector variety.
Latest exercise noticed by means of September and October 2025, mixed with new software releases in January 2026, signifies ongoing marketing campaign persistence. The campaigns exhibit technical maturation from primary terminal implementations to cross-platform desktop functions with automated distribution mechanisms and superior evasion capabilities.
CRIL’s investigation recognized coordinated abuse of authentication endpoints throughout the telecommunications, monetary companies, e-commerce, ride-hailing, and authorities sectors, collectively concentrating on infrastructure in West Asia, South Asia, and Japanese Europe.
Key Takeaways
- Persistent Evolution: Repository modifications noticed by means of late 2025, with new regional variants launched in January 2026
- Cross-Platform Development: Transition from terminal instruments to Electron-based desktop functions with GUI and auto-update mechanisms
- Multi-Vector Capabilities: Mixed SMS, OTP, voice name, and e-mail bombing, enabling sustained harassment campaigns
- Efficiency Optimization: Implementation in Go, claiming important pace benefits with FastHTTP library integration
- Superior Evasion: Proxy rotation, Consumer-Agent randomization, request timing variation, and concurrent execution capabilities (75% SSL bypass prevalence)
- Broad Infrastructure Publicity: ~843 authentication endpoints throughout ~20 repositories spanning a number of trade verticals
- Low Detection Charges: Multi-stage droppers and obfuscation methods evade antivirus detection on the time of study
Discovery and Attribution
What started within the early 2020s as remoted SMS bombing pranks amongst tech-savvy people has advanced into a complicated ecosystem of automated harassment instruments. An “SMS bomber” or “TP Bombers” can overwhelm a telephone quantity with a barrage of automated textual content messages – initially emerged as rudimentary Python scripts shared on coding boards.
These early implementations have been crude, concentrating on solely a handful of regional service suppliers and utilizing manually collected API endpoints. Given the dramatic transformation of the digital risk panorama lately, pushed by the proliferation of public code repositories, the commoditization of assault instruments, and the growing sophistication of risk actors.
Our investigation into this evolving risk started with routine monitoring of malicious code repositories and underground dialogue boards. What we found was way more intensive: a well-organised, quickly increasing ecosystem characterised by cross-platform device growth, worldwide collaboration amongst risk actors, and an alarming pattern towards commercialization.
Repository Evaluation and Dataset Composition
Malicious actors have weaponised GitHub as a distribution platform for SMS and OTP-bombing instruments, creating a whole bunch of malicious repositories since 2022. Our investigation analyzed round 20 of essentially the most lively and lately maintained repositories to characterize present assault capabilities.
Throughout these repositories, there are ~843 susceptible, catalogued API endpoints from legit organizations: e-commerce platforms, monetary establishments, authorities companies, and telecommunications suppliers.
Every endpoint lacks sufficient fee limiting or CAPTCHA safety, enabling automated exploitation. Goal lists span seven geographic areas, with concentrated give attention to India, Iran, Turkey, Ukraine, and Japanese Europe.
Repository maintainers present instruments in seven programming languages and frameworks, from easy Python scripts to cross-platform GUI functions. This variety allows attackers with minimal technical information to execute harassment campaigns with out understanding the underlying exploitation mechanics.
Assault Ecosystem: By The Numbers
Our evaluation of lively SMS bombing repositories provides us an perception into the true scale and class of this risk panorama:
Regional Focusing on Distribution
Iran-focused endpoints dominate the noticed pattern at 61.68% (~520 endpoints), adopted by India at 16.96% (~143 endpoints). This focus suggests coordinated growth efforts concentrating on particular telecommunications infrastructure.
Net-Primarily based SMS Bombing Companies
Accessibility and Risk Escalation
In parallel with the open-source repository ecosystem, a thriving industrial sector of web-based SMS-bombing companies exists.
These platforms symbolize a big escalation in risk accessibility, eradicating all technical obstacles to conducting assaults. Not like repository-based instruments that require customers to obtain code, configure environments, and execute instructions, these net companies provide point-and-click interfaces accessible from any browser or cell machine.
Misleading Advertising and marketing Practices
Our evaluation recognized quite a few lively net companies working overtly by way of search-engine-indexed domains. These companies make use of subtle advertising methods, positioning themselves as ‘SMS prank instruments’ or ‘SMS testing companies’ whereas offering the precise performance required for harassment campaigns.
Knowledge Harvesting and Resale Operations
Though these web sites current themselves as benign prank instruments, they function a predatory data-collection mannequin wherein customers’ telephone numbers are systematically harvested for secondary exploitation. These collected contact numbers are subsequently used for spam campaigns and rip-off operations, or monetized by means of resale as lead lists to third-party spammers and scammers. This creates a dual-threat mannequin: customers inadvertently expose each their targets and themselves to ongoing spam victimization, whereas platform operators revenue from each service charges and the commodification of harvested contact knowledge.
Technical Evaluation
Assault Methodology
SMS bombing assaults observe a predictable workflow that exploits weaknesses in API design and implementation.
Section 1: API Discovery
Attackers establish susceptible OTP endpoints by means of a number of methods:
- Handbook Testing: Figuring out login pages and registration varieties that set off SMS verification
- Automated Scanning: Utilizing instruments to probe widespread API paths like /api/send-otp, /confirm/sms, /auth/send-code
- Supply Code Evaluation: Inspecting cell functions and net functions for hardcoded API endpoints
- Shared Intelligence: Leveraging community-maintained lists of susceptible endpoints on boards and GitHub
Business Sector Focusing on Patterns
Our evaluation reveals systematic concentrating on throughout a number of trade verticals, with telecommunications and authentication companies comprising almost half of all noticed endpoints.
Section 2: Instrument Configuration
Fashionable SMS bombing instruments require minimal setup:
- Multi-threading: Simultaneous requests to a number of APIs
- Proxy Assist: Rotation of IP addresses to evade fee limiting
- Randomization: Variable delays between requests to look extra legit
- Persistence: Computerized retry mechanisms and error dealing with
- Reporting: Actual-time statistics on profitable message deliveries
Attacker Know-how Stack Evolution
An in depth evaluation of the ~20 repositories reveals important technical sophistication and platform diversification:
Section 3: Assault Execution
As soon as configured, the device initiates a flood of legitimate-looking API requests.
Assault Vector Prevalence Evaluation
Our evaluation reveals the distribution of assault strategies throughout the ~843 noticed endpoints:
Technical Sophistication: Evasion Strategies
Evaluation of the ~20 repositories reveals widespread adoption of anti-detection measures designed to bypass widespread safety controls.
Affect Evaluation
Particular person Customers
For finish customers focused by SMS bombing assaults, the results embrace:
| Affect Kind | Description |
| Gadget Overload | Tons of or 1000’s of incoming messages degrade machine efficiency. |
| Communication Disruption | Reliable messages are buried below spam, doubtlessly resulting in missed essential notifications. |
| Inbox Capability | SMS storage limits reached, stopping the receipt of latest messages. |
| Battery Drain | Fixed notifications deplete the affected machine’s battery. |
| MFA Fatigue | Overwhelming authentication requests create safety blind spots. |
| Knowledge Harvesting | Prank websites for SMS bombing seemingly promote or reuse knowledge for fraud or scams. |
Organizations
Companies whose APIs are exploited face a number of challenges:
| Affect Class | Affect Kind | Particulars |
| Monetary Affect | Price per OTP SMS | $0.05 to $0.20 per message |
| Assault price (10,000 messages) | $500 to $2,000 per assault | |
| Unprotected endpoints | Month-to-month payments can escalate to important excessive quantities. | |
| Operational Affect | Consumer entry points | Reliable customers are unable to obtain verification codes |
| Customer support | Overwhelmed with complaints | |
| SMS supply | Delays affecting all prospects | |
| Regulatory compliance | Potential violations if customers can’t entry accounts | |
| Reputational Affect | Media protection | Unfavourable social media protection |
| Buyer belief | Erosion of buyer confidence | |
| Model harm | Affiliation with spam and poor safety | |
| Aggressive place | Potential lack of enterprise to opponents |
Mitigation Methods: Proof-Primarily based Suggestions
Primarily based on evaluation of profitable bypass methods throughout ~20 repositories, the next mitigation methods are prioritized by effectiveness in opposition to noticed assault patterns. Implementation of those controls addresses the first exploitation vectors recognized in our analysis.
For Service Suppliers (API Homeowners)
CRITICAL Precedence
| 1. Implement Complete Charge Limiting | |
| Rationale | 67% of focused endpoints lack primary fee controls |
| Implementation | Per-IP Limiting: Most 5 OTP requests per hour. Per-Cellphone Limiting: Most 3 OTP requests per quarter-hour. Per-Session Limiting: Most 10 complete verification makes an attempt |
| Proof | Would have blocked 81% of noticed assault patterns |
| 2. Deploy Dynamic CAPTCHA | |
| Rationale | 33% of instruments exploit hardcoded reCAPTCHA tokens |
| Implementation | Use reCAPTCHA v3 with dynamic scoring. Rotate website keys repeatedly. Implement problem escalation for suspicious behaviour |
| Proof | Static CAPTCHA is defeated in many of the repositories |
| 3. SSL/TLS Verification Enforcement | |
| Rationale | 75% of instruments disable certificates validation to bypass safety controls |
| Implementation | Allow HSTS (HTTP Strict Transport Safety) headers, implement certificates pinning for cell functions. Monitor and alert on certificates validation errors |
| Proof | The commonest evasion approach noticed throughout repositories |
HIGH Precedence
| Management | Rationale | Implementation Steering |
| 4. Consumer-Agent Validation | 58.3% of instruments randomize Consumer-Agent headers to evade detection | Keep a whitelist of legit shoppers. Cross-validate Consumer-Agent with different headers Flag mismatched browser/OS mixtures |
| 5. Request Sample Evaluation | Automated instruments exhibit constant timing patterns, not like human habits | Keep a whitelist of legit shoppers. Cross-validate Consumer-Agent with different headers. Flag mismatched browser/OS mixtures |
| 6. Cellphone Quantity Validation | Prevents abuse of quantity era algorithms and invalid targets | Monitor for sub-100-ms request interval. Detect sequential API endpoint testing. Flag a number of failed CAPTCHA makes an attempt |
For Enterprises (API Customers)
| Mitigation Space | Beneficial Actions |
| SMS Price Monitoring | Set spending alerts at $100, $500, and $1,000 thresholds. Evaluate every day SMS volumes for anomalies. Determine and examine anomalous spikes instantly |
| Multi-Issue Authentication Hardening | Mandate rate-limiting necessities in service-level agreements Require CAPTCHA implementation on all OTP endpoints Request month-to-month safety and abuse reviews. Embrace SMS abuse legal responsibility clauses in contracts |
| Vendor Safety Necessities | Mandate rate-limiting necessities in service-level agreements. Require CAPTCHA implementation on all OTP endpoints. Request month-to-month safety and abuse reviews. Embrace SMS abuse legal responsibility clauses in contracts |
For People
| Safety Space | Beneficial Actions |
| Quantity Safety | Doc assault timing, quantity, and sender info File police reviews for harassment or threats. Request service help in blocking supply numbers. Monitor all accounts for unauthorized entry makes an attempt |
| MFA Finest Practices | Doc assault timing, quantity, and sender info. File police reviews for harassment or threats. Request service help in blocking supply numbers. Monitor all accounts for unauthorized entry makes an attempt |
| Incident Response | Choose authenticator apps (Google Authenticator, Authy) over SMS By no means approve sudden or unsolicited MFA prompts. Contact the service supplier instantly if SMS bombing happens |
Conclusion
The SMS/OTP bombing risk panorama has matured considerably between 2023 and 2026, evolving from easy harassment instruments into subtle assault platforms with industrial distribution. Our evaluation of ~20 repositories containing ~843 endpoints reveals systematic concentrating on throughout a number of industries and areas, with focus in Iran (61.68%) and India (16.96%).
The emergence of Go-based high-performance instruments, cross-platform GUI functions, and Telegram bot interfaces signifies the professionalization of this assault vector. With 75% of analyzed instruments implementing SSL bypass and 58% utilizing Consumer-Agent randomization, defenders face subtle adversaries concurrently using a number of evasion methods.
Organizations should prioritize complete fee limiting, dynamic CAPTCHA implementation, and sturdy monitoring to realize the projected 85%+ assault prevention effectiveness. The monetary impression—doubtlessly exceeding $50,000 month-to-month for unprotected endpoints—justifies speedy funding in defensive measures.
Because the ecosystem continues to evolve, steady monitoring of underground boards, repository exercise, and rising assault patterns stays important for sustaining efficient defenses in opposition to this persistent risk.
MITRE ATT&CK® Strategies
| Tactic | Approach ID | Approach Identify |
| Preliminary Entry | T1190 | Exploit Public-Going through Utility |
| Execution | T1059.006 | Command and Scripting Interpreter |
| Protection Evasion | T1036.005 | Masquerading: Match Reliable Identify or Location |
| Protection Evasion | T1027 | Obfuscated Information or Data |
| Protection Evasion | T1553.004 | Subvert Belief Controls: Set up Root Certificates |
| Protection Evasion | T1090.002 | Proxy: Exterior Proxy |
| Credential Entry | T1110.003 | Brute Pressure: Password Spraying |
| Credential Entry | T1621 | Multi-Issue Authentication Request Era |
| Affect | T1499.002 | Endpoint Denial of Service: Service Exhaustion Flood |
| Affect | T1498.001 | Community Denial of Service: Direct Community Flood |
| Affect | T1496 | Useful resource Hijacking |
