Executing real-time message monitoring to identify potentially malicious messages and generate instream alerts

1. A computing platform, comprising:

at least one processor;

a communication interface; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

monitor a first plurality of messages received by a messaging server associated with an operator;

detect that a first message of the first plurality of messages is potentially malicious;

in response to detecting that the first message of the first plurality of messages is potentially malicious, execute one or more protection actions, wherein executing the one or more protection actions comprises:

sending, to the messaging server associated with the operator, a first alert message indicating that the first message is potentially malicious, wherein sending the first alert message to the messaging server causes the messaging server to deliver the first alert message in a same conversation thread as the first message;

monitor a second plurality of messages received by the messaging server associated with the operator;

detect that a second message of the second plurality of messages is potentially malicious;

identify an external entity being impersonated in the second message of the second plurality of messages;

identify that the external entity is also being impersonated in the first message of the first plurality of messages;

generate a second alert message comprising information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise a malicious campaign of messages targeting customers of the external entity; and

send, via the communication interface, to a computer system of the external entity, the second alert message comprising the information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise the malicious campaign.

2. The computing platform of claim 1 , wherein monitoring the first plurality of messages received by the messaging server associated with the operator comprises:

sending, via the communication interface, to the messaging server associated with the operator, a request for new messages being processed by the messaging server associated with the operator; and

receiving, via the communication interface, from the messaging server associated with the operator, the first plurality of messages.

3. The computing platform of claim 1 , wherein monitoring the first plurality of messages received by the messaging server associated with the operator comprises:

monitoring one or more short message service (SMS) messages received by the messaging server for delivery;

monitoring one or more multimedia messaging service (MMS) messages received by the messaging server for delivery; or

monitoring one or more rich communication services (RCS) messages received by the messaging server for delivery.

4. The computing platform of claim 1 , wherein detecting that the first message of the first plurality of messages is potentially malicious comprises identifying that the first message of the first plurality of messages contains spam content.

5. The computing platform of claim 1 , wherein detecting that the first message of the first plurality of messages is potentially malicious comprises identifying that the first message of the first plurality of messages contains phishing content.

6. The computing platform of claim 1 , wherein executing the one or more protection actions comprises:

generating the first alert message comprising information indicating that the first message of the first plurality of messages is potentially malicious, wherein generating the first alert message comprises inserting, into the first alert message, a source identifier associated with the first message of the first plurality of messages.

7. The computing platform of claim 6 ,

wherein generating the first alert message comprising the information indicating that the first message of the first plurality of messages is potentially malicious comprises inserting, into the first alert message, a trusted source identifier associated with the computing platform, and

wherein sending the first alert message to the messaging server associated with the operator causes the messaging server associated with the operator to deliver the first alert message as originating from the trusted source identifier associated with the computing platform.

8. The computing platform of claim 6 ,

wherein sending the first alert message to the messaging server associated with the operator causes the messaging server associated with the operator to deliver the first alert message to at least one computing device associated with an intended recipient of the first message of the first plurality of messages prior to delivering the first message of the first plurality of messages to the at least one computing device associated with the intended recipient of the first message of the first plurality of messages.

9. The computing platform of claim 1 , wherein executing the one or more protection actions comprises:

generating a third alert message comprising information associated with the first message of the first plurality of messages; and

sending, via the communication interface, to the messaging server associated with the operator, the third alert message comprising the information associated with the first message of the first plurality of messages,

wherein sending the third alert message to the messaging server associated with the operator causes the messaging server associated with the operator to write one or more log lines to one or more system logs associated with the operator.

10. The computing platform of claim 1 , wherein executing the one or more protection actions comprises:

identifying the external entity associated with the potentially malicious content included in the first message of the first plurality of messages;

generating a third alert message comprising information associated with the first message of the first plurality of messages; and

sending, via the communication interface, to the computer system of the external entity associated with the potentially malicious content included in the first message of the first plurality of messages, the third alert message comprising the information associated with the first message of the first plurality of messages.

11. The computing platform of claim 10 , wherein identifying the external entity associated with the potentially malicious content included in the first message of the first plurality of messages comprises identifying the external entity associated with the potentially malicious content included in the first message of the first plurality of messages based on one or more templates associated with the external entity.

12. The computing platform of claim 10 , wherein generating the third alert message comprising the information associated with the first message of the first plurality of messages comprises inserting, into the third alert message, information indicating that the first message of the first plurality of messages is associated with the malicious campaign of messages targeting users associated with the external entity.

13. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

detect that a third message of the first plurality of messages has changed from a legitimate state to a malicious state; and

in response to detecting that the third message of the first plurality of messages has changed from the legitimate state to the malicious state:

generate a fourth alert message comprising information indicating that the second message of the first plurality of messages is malicious; and

send, via the communication interface, to the messaging server associated with the operator, the fourth alert message comprising the information indicating that the third message of the first plurality of messages is malicious.

14. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

in response to detecting that the second message of the second plurality of messages is potentially malicious, execute one or more second protection actions, wherein executing the one or more second protection actions comprises:

generating a third alert message comprising information indicating that the second message of the second plurality of messages is potentially malicious; and

sending, via the communication interface, to the messaging server associated with the operator, the third alert message comprising the information indicating that the second message of the second plurality of messages is potentially malicious,

wherein sending the third alert message to the messaging server associated with the operator causes the messaging server associated with the operator to deliver the third alert message comprising the information indicating that the second message of the second plurality of messages is potentially malicious to at least one computing device associated with an intended recipient of the second message of the second plurality of messages.

15. A method, comprising:

at a computing platform comprising at least one processor, a communication interface, and memory:

monitoring, by the at least one processor, a first plurality of messages received by a messaging server associated with an operator;

detecting, by the at least one processor, that a first message of the first plurality of messages is potentially malicious;

in response to detecting that the first message of the first plurality of messages is potentially malicious, executing, by the at least one processor, one or more protection actions, wherein executing the one or more protection actions comprises:

sending, to the messaging server associated with the operator, a first alert message indicating that the first message is potentially malicious, wherein sending the first alert message to the messaging server causes the messaging server to deliver the first alert message in a same conversation thread as the first message;

detecting that a second message of a second plurality of messages is potentially malicious;

identifying an external entity being impersonated in the second message of the second plurality of messages;

identifying that the external entity is also being impersonated in the first message of the first plurality of messages;

generating a second alert message comprising information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise a malicious campaign of messages targeting customers of the external entity; and

sending, via the communication interface, to a computer system of the external entity, the second alert message comprising the information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise the malicious campaign.

16. The method of claim 15 , wherein monitoring the first plurality of messages received by the messaging server associated with the operator comprises:

sending, via the communication interface, to the messaging server associated with the operator, a request for new messages being processed by the messaging server associated with the operator; and

receiving, via the communication interface, from the messaging server associated with the operator, the first plurality of messages.

17. The method of claim 15 , wherein monitoring the first plurality of messages received by the messaging server associated with the operator comprises:

monitoring one or more short message service (SMS) messages received by the messaging server for delivery;

monitoring one or more multimedia messaging service (MMS) messages received by the messaging server for delivery; or

monitoring one or more rich communication services (RCS) messages received by the messaging server for delivery.

18. The method of claim 15 , wherein detecting that the first message of the first plurality of messages is potentially malicious comprises identifying that the first message of the first plurality of messages contains spam content.

19. The method of claim 15 , wherein executing the one or more protection actions comprises:

generating the first alert message comprising information indicating that the first message of the first plurality of messages is potentially malicious, wherein generating the first alert message comprises inserting, into the first alert message, a source identifier associated with the first message of the first plurality of messages.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

monitor a first plurality of messages received by a messaging server associated with an operator;

detect that a first message of the first plurality of messages is potentially malicious;

in response to detecting that the first message of the first plurality of messages is potentially malicious, execute one or more protection actions, wherein executing the one or more protection actions comprises:

sending, to the messaging server associated with the operator, a first alert message indicating that the first message is potentially malicious, wherein sending the first alert message to the messaging server causes the messaging server to deliver the first alert message in a same conversation thread as the first message;

monitor a second plurality of messages received by the messaging server associated with the operator;

detect that a second message of the second plurality of messages is potentially malicious;

identify an external entity being impersonated in the second message of the second plurality of messages;

identify that the external entity is also being impersonated in the first message of the first plurality of messages;

generate a second alert message comprising information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise a malicious campaign of messages targeting customers of the external entity; and

send, via the communication interface, to a computer system of the external entity, the second alert message comprising the information indicating that the first message of the first plurality of messages and the second message of the second plurality of messages comprise the malicious campaign.