There are provided a method and apparatus for detecting and handling a malicious act that performs billing and takes a financial gain using a short message service (SMS) in real time. The apparatus includes an SMS collecting module configured to collect an SMS message sent from or received in a smartphone; an SMS parsing module configured to parse the collected SMS message; an SMS examining module configured to examine at least one field of the parsed SMS message and determine whether the SMS message is a malicious act-related message based on an access control list (ACL) and an SMS signature DB; and an installing app examining module configured to examine SMS message sending permission of an app to be installed in the smartphone and a priority of an SMS receiver process included in the app and determine whether the app has a possibility of being malware.