SilentAir Spies Intercept SMS 2FA Codes via SS7 Networks
Swedish firm Enea uncovered SilentAir, a new spying group that used hacked equipment inside mobile operators in at least six Asian countries to intercept calls and texts of selected targets, mostly in Taiwan.
⚡ Why it matters
It shows SMS one-time codes can be intercepted inside the telecom network without touching your phone. Authenticator apps, passkeys and security keys are much safer.
Enea is highly confident SilentAir is backed by a state and links it to China with low confidence, citing its focus on Taiwan, the absence of Chinese targets and activity matching Chinese working hours.
How the attack works
Mobile operators use the SS7 and Diameter protocols to route calls, texts and roaming over the shared IPX network, which relies on trust between operators. From hacked equipment, SilentAir sent the victim's home network an UpdateLocation message claiming the victim's phone was now on its network. When the home network accepted it, the victim's calls and texts were diverted to the attackers.
In some cases, Enea saw 2FA codes intercepted right after the diversion, suggesting attempts to break into the victims' other accounts. The group also sent silent SMS messages that never show on the phone, possibly to confirm interception worked.
Who was targeted
Most targets were in Taiwan and other East and Southeast Asian networks, plus occasional targets across East Africa, Central Asia, the Middle East and Europe, among them political and government figures. Enea has tracked the activity since early 2025 and notified the affected operators. It says the group is disrupted for now but could return.
What to do
- Move important accounts from SMS codes to an authenticator app, passkey or security key.
- Operators should deploy SS7 and Diameter signaling firewalls and watch for suspicious UpdateLocation messages.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.