It may be:
It is imperative to state clearly:
App/Website → SMS Gateway → Compromised Signaling Router → Private Dedicated API → Fraudster's Script
Are you asking for a of how these bots function, or are you concerned about a specific account being compromised?