A warehouse supervisor gets a text message: the shift schedule has changed, tap the link to confirm. It looks like the usual scheduling service, so she taps it on her own phone and signs in. The link was never from the scheduling service, and her login now belongs to someone else. No attachment, no malware, no corporate laptop involved, just a message on a trusted channel and a link.
Messages and images are among the most common ways an attack arrives, because they travel on the channels people use all day and expect to trust. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists message-based vectors, email, SMS, RCS, instant messaging and collaboration tools, and image-based vectors, QR codes, embedded content and CAPTCHA abuse. This lesson covers how each one is used, what it looks like to the target, and the primary defense. The social-engineering techniques that make these messages persuasive, such as phishing and pretexting, are taught in their own section; here the focus is the delivery route.
Email is still the highest-volume delivery route
Email remains one of the most heavily used vectors, for one reason: every organization has it, every employee reads it, and a message can carry a link, an attachment, or both. An attacker needs no foothold and no vulnerability to send one. The message only has to persuade the reader to click or open.
What it looks like on the receiving end is a message that seems routine: an invoice, a shared file, a password-reset notice, a shipping update. The sender address may be spoofed, look-alike (a domain one character off), or a real account the attacker has already taken over, which is the hardest to catch because the mail is genuinely from a known contact. The payload is usually a link to a credential-harvesting page or a malicious file, both covered in the next lesson.
The primary defenses are layered. A secure email gateway filters spam, known-bad links and malicious attachments before delivery. Sender authentication, the SPF, DKIM and DMARC records taught in the email-security section, lets receiving servers reject forged senders. Link rewriting and sandboxing detonate suspicious links and files away from the user. And because no filter catches everything, user awareness is the last layer. On the exam, email as a vector pairs with these controls; a scenario about forged sender domains points to SPF, DKIM and DMARC specifically.
SMS and RCS move the attack onto the phone
Text messaging shifts the attack to a device that is personal, always in hand, and usually outside the company's filtering. Short Message Service (SMS) is plain text with a link or a phone number, and it carries no sender authentication at all, so the "from" field is trivial to forge. A smishing text impersonates a bank, a delivery company, or the recipient's own employer, and the small screen hides the warning signs a desktop mail client would show, such as the real destination of a link.
Rich Communication Services (RCS) is the newer successor to SMS, now widely supported on both Android and, since recent versions, iPhone. It adds read receipts, typing indicators, high-resolution images and branded sender profiles. Those features help attackers too. They let legitimate businesses send verified, logo-stamped messages, but a convincing branded message is also a more persuasive lure, and users may trust the richer format more than a plain text. RCS is newer to the exam, so recognize it as the modern replacement for SMS with the same core risk: an untrusted link arriving on a phone.
The defense is partly technical and partly human. Mobile device management can restrict what managed phones install and warn on risky links; carriers filter some spam. But the strongest control is a habit: never act on an unexpected text by using the link or number it provides. Look the organization up independently. On the exam, a text message with a link that creates urgency is the signature of this vector.