Someone received a text from me that I didn't send. There is definitely a virus involved. If so, who has it, the sender or the receiver?
Someone received a text from me that I didn't send. That someone happened to be my friend. I asked for a screenshot of the text in question, and it is a text from my number with spam I did not send. The text said "Visit http://legacy.operator.com:8080/webgui/vm[...] to read your new MMS." and it appears in line with the actual dialogue I'd had with this person.
I could see no record of sending that text, from my phone. They received it around 10 AM, and at 11:30 am I received a text from an unrecognized number with similar spam but in German. An odd coincidence or just a sign spammers were active all around. In any case, because of the difference in timing, at least the German text couldn't have infected me and caused the text to my friend.
Neither of us clicked either spam attack's link. I expect the German one I received can safely be ignored. But I am not sure about the other text which my friend received from my number and which I have no record of sending.
There are two possible scenarios:
There is a virus on the sender's phone, or the SMS was spoofed, as per the SMS Spoofing link in your post. According to my understanding, the most likely scenario is that the virus must be in your phone that WebRoot is not able to detect. A good way to check is to ask some of your other contacts to see if they have received a similar text. If this were a virus, Your other contact is expected to receive a similar message.
If this was done via SMS spoofing, this implies that whoever was trying to compromise the receiver's phone was aware of your pre-existing relationship with the receiver, assuming they weren't just spoofing random numbers. This would certainly imply a targeted attack.