Android "SMS of Death": MyCERT warns of call and SMS outages

MyCERT has warned about a flaw in Android, called the "SMS of Death", in its alert MA-1497. One specially made SMS that the user never sees can crash the phone's calling and messaging service, drop a call in progress and cut the signal for a second or two, again and again. Google has not issued a fix. Keep your phone updated and know the warning signs.

Who is affected?

MyCERT says the problem has been reproduced on Google Pixel phones, on Android 12, and on Samsung Galaxy and A-series phones. iPhones are not part of this alert. MyCERT has not confirmed any attacks on Malaysian users, and it does not yet know whether Malaysian mobile networks pass this kind of message through.

What can it do?

• Calls in progress drop, MyCERT says including calls to 999 or 112.
• Signal goes on and off every one to two seconds. Because the network keeps sending the message again, this can carry on for up to a week.
• The researcher reports that about 30 messages sent quickly can leave the phone stuck restarting, with no calls or SMS at all. MyCERT has not reproduced this part itself.

MyCERT points out the fraud risk: while your phone has no calls or SMS, you cannot receive bank calls or SMS codes, and you cannot call the bank yourself. That is when a scammer could try to take over an account.

What to do

1. Install phone system updates as soon as Samsung, Xiaomi, OPPO or your phone maker releases them. A fix could come from the maker before Google.
2. If your bank's app offers in-app approval instead of SMS codes, consider turning it on. MyCERT notes that app notifications are not affected.
3. If your phone suddenly drops calls and loses signal every few seconds, especially after odd calls or messages, use another phone to call your bank and check for unusual activity. MyCERT says moving the SIM to a non-Android phone lets the network clear the stuck message.
4. If your phone keeps restarting, do not wipe it straight away. Take it to the maker's service centre, especially if it uses an eSIM only.
5. Share this with staff who use Android phones for work banking or company accounts.

How SyncTech can help

Scam calls and SMS often come together with fake emails. Our anti-spam email hosting filters phishing mail before it reaches your staff, and our help centre lists how to reach us.

Source and credit

We are sharing this news from MyCERT (CyberSecurity Malaysia). This summary is written by Synctech in our own words.

• MA-1497.112026: MyCERT Alert - Zero-Click "SMS of Death" Android Telephony Denial of Service via a Malformed WAP Push Data SMS, MyCERT, 5 November 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=b8893719-84b0-42f2-9480-b8d887749291

Retrieved 6 November 2026. Android, Google Pixel, Samsung Galaxy, Xiaomi, OPPO and iPhone are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.