To protect users from such attacks, Apple iMessage automatically disables links in messages received from unknown senders, whether that be an email address or phone number.

However, Apple told BleepingComputer that if a user replies to that message or adds the sender to their contact list, the links will be enabled. (OHHH NOOOOH)

As you can see below, a fake USPS shipping issue and a fake unpaid road toll text were sent from unknown senders, and iMessage automatically disabled the links.

As users have become used to typing STOP, Yes, or NO to confirm appointments or opt out of text messages, the threat actors are hoping this familiar act will lead the text recipient to reply to the text and enable the links. Doing so will enable the links again and turn off iMessage's built-in phishing protection for this text.