Three men in Toronto just got arrested for driving around with a fake cell tower in their car, blasting phishing texts to every phone in range. Meanwhile, Robinhood’s account signup flow was quietly weaponized to deliver phishing emails through legitimate infrastructure. These aren’t isolated incidents. They’re the same problem wearing different clothes.

Two Attacks, One Pattern

The Toronto SMS blaster crew used a rogue IMSI catcher to impersonate a legitimate cell tower. Nearby phones connected automatically, received phishing texts, and had no reason to distrust them. The messages looked like they came from a real carrier. That’s the whole game: borrow legitimacy from infrastructure people already trust.

Robinhood’s flaw worked the same way. Threat actors exploited the account creation process to inject phishing content into automated emails that came from Robinhood’s own sending infrastructure. Recipients saw a legitimate sender domain, a familiar brand, and a message crafted to trigger panic. The platform became the weapon.

What connects these two? Neither attack required breaking into a hardened system. Both found a softer seam, a process or protocol that was designed to be open and was left just open enough to abuse. That’s the threat model a lot of security teams underestimate.

Where ipban and Edge Controls Actually Help

SMS blasters are a physical attack. Your firewall rules aren’t stopping a car parked on a nearby street. But the infrastructure side of these campaigns, the C2 callbacks, the credential-harvesting pages, the attacker-controlled domains that phishing links point to, all of those have IP addresses. That’s where edge-layer blocking earns its keep.

When someone clicks a phishing link and lands on a credential harvester, that harvester has to communicate back somewhere. Automated IP reputation feeds, behavioral anomaly detection on outbound DNS, and tools like ipban that monitor and block based on repeated malicious contact patterns all create friction at that follow-on phase. Not every attack gets stopped at the front door. Stopping the exfiltration leg is just as valuable.

For the Robinhood-style platform abuse scenario, the controls look different but the principle is identical. Repeated account creation attempts from the same IP range, abnormal velocity in signup flows, and API abuse patterns are all detectable and blockable before an attacker manages to fire off a significant volume of phishing emails. Rate limiting and IP-based behavioral blocking work here. The attack depends on volume. Take away volume, and the economics break.

Concrete steps your team can act on right now:

• Audit every outward-facing signup or form submission endpoint for rate limiting. If there’s no IP-based throttle, there’s a vector.
• Subscribe to threat intelligence feeds that include phishing kit hosting IPs and block them at the perimeter, not just in email filters.
• Monitor outbound DNS for newly registered domains and domains with low reputation scores; phishing infrastructure almost always uses fresh domains.
• For any public-facing API, add honeypot fields or behavioral tripwires that flag automation before it achieves its goal.
• Review your email sending platform’s abuse reporting mechanisms; if attackers can use your own infrastructure to send phish, you need to know how fast you can kill that pipeline.

The Bigger Problem Is Trust Abuse

The FTC reported that Americans lost over $2.1 billion to social media scams in 2025. That number doesn’t capture losses from carrier-based phishing or platform-abused email flows, so the real figure is higher. A lot higher.

What’s driving the surge isn’t technical sophistication. It’s trust exploitation at scale. Attackers are finding that it’s cheaper and more effective to abuse a platform people already believe in than to build convincing fake infrastructure from scratch. Robinhood’s email system is trustworthy. A major carrier’s SMS is trustworthy. That trust is the vulnerability.

Security hardening has to account for this. Defense in depth means more than having a firewall and an EDR. It means auditing the trust signals your own platforms emit, and asking whether an adversary could hijack any of them. Your email sending domain, your API, your customer notification system: all of these are surfaces attackers are now probing.

Threat detection can’t wait for the payload to arrive. If your posture is purely reactive, by the time a phishing email lands in an inbox or a credential harvester captures a login, the hardest work for the attacker is already done. Automated blocking at the IP and behavioral layer is the control that intercepts the preparation phase, the scanning, the account creation abuse, the infrastructure setup.

Physical attacks like SMS blasters are harder to block remotely, but they’re also easier to prosecute and harder to scale. The Toronto arrests prove that. The platform-abuse vector is the one that scales, automates, and costs attackers almost nothing. That’s the one that deserves your hardening budget right now.

Frequently Asked Questions

Can SMS blaster attacks be blocked at the network level?

Not directly. IMSI catchers operate at the radio layer, below your network controls. The phishing infrastructure they point to, credential harvesters and C2 endpoints, can be blocked via IP reputation and DNS filtering, but the initial message delivery bypasses traditional network security.

How do attackers abuse legitimate platform email systems?

By exploiting unauthenticated or weakly validated workflows like account creation forms. The attacker triggers a system-generated email containing attacker-controlled content. Because the email originates from a legitimate domain, it passes SPF, DKIM, and DMARC checks.

Does IP banning help against phishing attacks specifically?

At the campaign infrastructure level, yes. Blocking known phishing kit hosting IPs, credential harvester endpoints, and attacker-controlled redirect chains reduces successful credential captures even after a user clicks a link. It’s a compensating control, not a primary one.

Sources

• Canada arrests three for operating “SMS blaster” device in Toronto
• Robinhood account creation flaw abused to send phishing emails
• FTC: Americans lost over $2.1 billion to social media scams in 2025