Leveraging Rich Communication Services (RCS) for Social Engineering Attacks

Rich Communication Services (RCS) provide an enhanced mobile messaging experience, making it a fertile ground for social engineering attacks. This article will guide you through leveraging RCS for creating high-yield phishing simulations, where the goal is to reveal weaknesses in an organization’s security awareness training. A successful RCS-based attack can closely mimic legitimate communications, leading to higher engagement rates. You’ll be able to construct an RCS message that employs psychological manipulation strategies like urgency and authority, seamlessly integrating into a target’s normal workflow, ensuring realistic results.

What makes RCS an attractive vector is its advanced features over traditional SMS, such as media support, rich cards, read receipts, and suggested actions. These can be exploited to craft messages that are not only visually appealing but also actionable and urgent. Ensuring that your communication seems legitimate involves understanding not only these features but also how they can be made to bypass user skepticism. After reading this guide, you will be equipped to design and deploy RCS-based social engineering attacks, effectively uncovering gaps that real actors might exploit, and gathering valuable insights.

Prerequisites and Setup

To execute RCS-based social engineering attacks, you need specific tools and environments that can simulate an RCS payload effectively. Here’s what you need:

Tools: Use platforms like GoPhish for managing campaigns, and the Google RCS API or other suitable RCS messaging platforms to deploy messages. GoPhish can be set up on a server running Linux with root access.
Environment: A test Android device or emulator capable of supporting RCS is essential. Additionally, ensure you have a network setup to capture payloads and responses for analysis via tools like Wireshark.
Configuration: Prepare your RCS messaging platform with appropriate sender IDs that mimic your target’s known contacts, adhering to real-world patterns. This includes configuring your domain with DMARC, DKIM, and SPF records to avoid immediate filtering.

Once you have these tools in place, make sure your messaging content is aligned with psychological triggers (such as urgency or authority) to engage your targets effectively. These setups allow you to craft RCS messages with a legitimate appearance, enhancing the likelihood of user interaction.

Step-by-Step Execution

Creating the Simulated Attack

RCS Message Crafting

Begin by crafting an RCS message that appears authentic to the target. This involves using variable data personalization, such as referencing previous interactions or ongoing company projects.

From: Corp IT Support <support@company.tech>

To: [Target's Phone Number]

Hello [First Name],

We've identified unusual activity in your account and require you to verify some details. Please find the secure link attached to maintain your account security:

[Secure Link Card]

Thank you,

Corporate IT Security Team

This RCS message is crafted to appear urgent and from your IT department, urging verification through suggested actions like “Verify Now” embedded on the card. These actions lead to a controlled site for credential harvesting.

Deploying the Attack

Using RCS to Execute

Deploy the previously created RCS message using a suitable RCS messaging platform. Here’s how the setup appears in practice:


gcloud rcs send \

  --phone="[Target's Phone Number]" \

  --message="json/rcs_message.json" \

  --project="[Your-GCP-Project-Id]"

This command uses the Google Cloud RCS service to send your crafted message, ensuring it’s routed through legitimate-looking channels.

Tracking Engagements

Capture and Analyze Responses

Leverage tools like Google Analytics or custom backend scripts to monitor interactions. When a target clicks through or submits data, take detailed notes on the engagement, observing what psychological triggers had the most effect.


/* Backend tracking example */

// Node.js Express snippet

app.post('/submit-data', (req, res) => {

  const { userData } = req.body;

  console.log(`User data received: ${userData}`);

  res.redirect('https://security.company.tech/thank-you');

});

This server-side script captures user input when they interact with your RCS message, enabling you to analyze which demographics or details lead to higher success rates.

Advanced Variations

Dynamic Content Personalization

To elevate engagement, inject dynamic content into messages. Use APIs to pull real-time data such as stock prices, weather updates, or personalized account information. Modifying your RCS payloads with real-time data increases perceived authenticity.


{ 

  "richCard": {

    "message": "Your account balance as of [DATE] is $[BALANCE]. Verify now for detailed statements.",

    "action": "VERIFY"

  }

}

This dynamic message element updates data points in real time, creating a more personalized and convincing narrative.

Employing Multimedia Enhanced Cards

Utilize multimedia within RCS cards to provide a visuallyenching and trustworthy message. For example, a video embed explaining vital security tips with CTA buttons enhances trust.


{ 

  "richCard": {

    "media": { 

      "contentUrl": "https://video.companyresources.com/securitytips.mp4"

    },

    "action": "LEARN MORE"

  }

}

Such multimedia cards, when presented professionally, increase the perceived legitimacy and urgency, prompting quicker action.

Good / Better / Best

Good: Basic RCS Message

A straightforward RCS message with a generic lure.


From: Generic Alerts

You've won a prize! Click here to claim!

This is functional but easily flagged as suspicious.

Better: Contextual Messaging

Messages tied to current events or personal circumstances.


From: Bank Security

Recent transaction alert. Validate your account now to avoid restrictions.

This aligns with typical alerts a user might expect, reducing immediate suspicion.

Best: Realistic Personalized Content

Tailored messages using real recipient data and linked to legitimate interactions.


From: John Doe

Hi [First Name], your quarterly performance review is scheduled. Review details here.

This perfectly mimics an expected communication, using detailed, relevant content.

Related Concepts

Leveraging RCS for social engineering shares tactical similarities with email phishing and vishing. These strategies exploit communications to gain unauthorized access or information through manipulation. Understanding these connections provides deeper insights into crafting more robust and convincing social engineering engagements, using varied delivery methods adapted to target-specific susceptibility.