Employees receive text messages on their company phones saying a parcel is being held and linking to a site that asks for a redelivery fee. The courier named in the message has no relationship with the company. Which threat vector is being used?
Select an answer to reveal the explanation.
Short Explanation
The question's asking HOW the attack reached the person, and here it rode in on a text message. That's the message-based vector, whether it arrives as plain SMS or as rich RCS chat. Don't let the courier name fool you -- that's just the costume the lure is wearing.
Full Explanation
Threat vectors describe the path an attacker uses to reach a target. Message-based vectors include email, Short Message Service, Rich Communication Services, instant messaging and collaboration tools. A fake delivery notice sent as a text message to a phone, carrying a link to a payment page, travels over SMS or RCS, so the vector is message-based; the social engineering technique itself is commonly called smishing. An image-based vector relies on content such as QR codes, embedded images or fake CAPTCHA challenges to carry the lure, and nothing here depends on an image. A browser-based vector abuses extensions, scripts, stored credentials, cookies or session tokens in the browser; the link may eventually open a browser, but the delivery path was the text message, not a browser component. A remote access-based vector targets services such as remote desktop, VNC or VPN, which are not involved in sending a text message. Exam caveat: the courier brand is impersonated, so this is not a supply chain vector; the courier's systems played no part. Operational check: report the sender to the carrier, block the linked domain at the DNS filter, warn staff with an example, and confirm whether any employee entered payment or credential details.