Your smartphone is now at risk from a surge in malicious messages that easily bypass network defenses to attack devices. You won’t realize you’ve been targeted until it’s too late, and Google warns Android users to change their settings to stop this.
We’re talking SMS blasters, “portable mobile phone stations,” one cyber agency explains, which are “carried in a rucksack and which allow the scammers to intercept signals and send manipulated text messages.”
Google warns these “cell-site simulators, also known as False Base Stations (FBS) or Stingrays” trick phones into connecting, treating it as genuine cell site. This is a traditional surveillance/intercept technology that has been repurposed to push out high-volume scam texts, avoiding the defenses built into legitimate networks.
“This method to inject messages entirely bypasses the carrier network,” Google says, “bypassing all the sophisticated network-based anti-spam and anti-fraud filters.”
Google’s issued its advice last summer, but these attacks have continued and are now escalating. Most rely on smartphones connecting to 2G networks, which do not carry the same level of security and encryption as 5G, 4G and even 3G connections.
“Downgrading the user’s connection to a legacy 2G protocol,” Google explains, “abuses the well known lack of mutual authentication in 2G and force connections to be unencrypted.” This enables a man-in-the-middle attack “to inject SMS payloads.”
Mitigation for most of these attacks is simple. “Android 12 introduced a user option to disable 2G at the modem level, a feature first adopted by Pixel. This option, if used, completely mitigates the risk from SMS Blasters.”
Google’s new Advanced Protection Mode, introduced with Android 16, completely disables 2G connections. Samsung’s Maximum Restrictions, now the default for new phones, enables users to disable 2G, albeit it’s not a mandatory setting.
If you’re attacked by an SMS Blaster, you won’t realize the texts are any different to the ones you usually receive. But instead of targeting your number, these attacks target your location, “blasting” out SMS messages to all local devices, thousands at a time.
This is one area where Android beats iPhone on the security front. There is no equivalent option to block 2G on Apple devices. Instead you’re reliant on the new spam filtering in iOS 26 and disabling links from unknown senders.
Apple’s Lockdown Mode does block 2G, but there we’re into sledgehammer-nut territory. That mode also locks down a raft of popular features, making your iPhone much more painful to use. It’s not recommended for everyday users.