This article published on 22nd Sep 2026.
NVD Release Date: 18th September 2026
Preface: When a fraudster uses virtual Direct Inward Dialing (DID) numbers to blast scam SMS messages, they intentionally create a fragmented digital trail designed to stall, confuse, and exhaust law enforcement resources.
Compared to regularly discovered SMS design flaws, the risk ratings for both are equal.
Even though criminal might only have one physical connection to the internet, they can buy hundreds of local or international DID numbers. A Service Provider assigns these virtual numbers to their system, mapping them to specific users, call queues, or automated menus.
Background: In the past, traditional Public Switched Telephone Networks (PSTN) required a physical copper wire for every single phone line. Today, an IP Phone SIP Trunk acts as a virtual pipeline over the internet.
A telecom provider can map a single pilot number (like your example, 3865xxx) and route an entire block of numbers—say, 999 different extensions—down that same virtual SIP trunk. Because SIP trunking makes it incredibly easy to programmatically change the outbound Caller ID, bad actors exploit it to cause havoc in distinct ways:
Snowshoe Spamming: Instead of blasting millions of spam calls from a single phone number (which would get blocked instantly by spam filters), scammers lease thousands of cheap virtual DID numbers. They cycle through them rapidly, spreading the “traffic footprint” so thin that automated carrier filters fail to detect them.
Virtual DID (Direct Inward Dialing) numbers and SMS design weaknesses form a highly dangerous combination that fuels modern cybercrime, especially smishing (SMS phishing) and automated account takeover. By combining cheap, untraceable cloud infrastructure with legacy cellular protocols that lack built-in security, fraudsters can bypass traditional authentication methods at an industrial scale.
Vulnerability details: CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.
Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/cve-2026-75895