The FBI issued a warning to all mobile users in America, to be vigilant for fraudulent text messages that they may receive. This is something that is currently occurring and citizens need to educate themselves on these types of fraudulent methods. These fraudulent messages might seem it come from higher authorities. Also, the message can contain information where citizens are asked to provide sensitive information.
Text Messages: State Warnings by FBI
Details were republished on 11 March 2025 with the information of new state-by-state warnings and the advice of the government for anyone who is receiving these dangerous messages. The FBI issued a warning of this threat that is currently taking place across America. It goes from state to state, and it targets citizens through malicious SMS (smishing) text. It does this by telling Android and iPhone users to delete any smishing texts received.
Due to this, cybercriminals have registered around 10,000 domains to start a new wave of attacks. It has been stated that these new text messages are easy to detect — delete them right away.
In addition, per Bleeping Computer, toll payment scam campaigns continue to spread, making it quite clear why so many new domains are required. Also, a significant wave of phishing text messages has caused several cities throughout the United States to issue warnings and this is why the FBI got involved, these places include:
- Annapolis,
- Boston,
- Greenwich,
- Denver,
- Detroit,
- Houston,
- Milwaukee,
- Salt Lake City,
- Charlotte,
- San Diego,
- San Francisco, and many others.”
Also, fake toll road scams have nearly quadrupled at the end of February 2025, in comparison to where the numbers were at during January 2025. The full list of most targeted cities can be found below:
- “Dallas, Texas
- Atlanta, Georgia
- Los Angeles, California
- Chicago, Illinois
- Orlando, Florida
- Miami, Florida
- San Antonio, Texas
- Las Vegas, Nevada
- Houston, Texas
- Denver, Colorado
- San Diego, California
- Phoenix, Arizona
- Seattle, Washington
- Indianapolis, Indiana
- Boardman, Ohio”
Understanding the treat
It is important to note that all the smishing texts are more than likely to follow a similar pattern. You have an unpaid bill and need to pay it urgently to avoid higher costs or worse. You are then provided with a link to the payment site – this is where the new domains come into play. Given iMessage blocks such links, the texts include instructions to either reply or copy the link into Safari to make payment.
In addition, the new report comes through Palo Alto Networks’ Unit 42. It was said that the new campaign entices users to reveal their personal and/or financial information. This may include the citizen’s credit or debit card and account information. The initial threats focused on toll scams, with state-specific payment links; the new set of domains adds delivery services into the mix.
In addition to the top-level domain, Bleeping Computer also noticed in a text they received in New York an indicated what to watch out for that this is a scam, because the dollar sign is indicated after the amount, rather than before, as is customary in the United States. Also, it indicates that the phishing scam was created by people who are situated outside of the United States.
What to look out for?
It can be stated that the toll scam is franchised out to local operators. However, it all seems to leverage a toolkit built by Chinese cybercrime groups. This may not be a surprise that the example root domains and fully qualified domain names shared by Unit 42 all share the Chinese .XIN TLD. Citizens have to take note because they can easily see how these domain names are created to entice a click:
- dhl.com-new[.]xin
- driveks.com-jds[.]xin
- ezdrive.com-2h98[.]xin
- ezdrivema.com-citations-etc[.]xin
- ezdrivema.com-securetta[.]xin
- e-zpassiag.com-courtfees[.]xin
- e-zpassny.com-ticketd[.]xin
- fedex.com-fedexl[.]xin
- getipass.com-tickeuz[.]xin
- sunpass.com-ticketap[.]xin
- thetollroads.com-fastrakeu[.]xin
- usps.com-tracking-helpsomg[.]xin