Spies Hijack Telecoms to Steal 2FA Codes

A state-sponsored group is hijacking mobile networks in Asia to intercept calls, texts, and even sensitive two-factor authentication codes.

A newly discovered state-sponsored espionage campaign, dubbed 'SilentAir', has been found actively compromising core telecommunications infrastructure. According to a report from cybersecurity firm Enea, the group has infiltrated mobile operator networks in at least six Asian countries to conduct surveillance. The primary goal of the campaign appears to be intercepting the phone calls, text messages, and sensitive data of specific individuals, with a significant focus on users in Taiwan. Enea assesses with high confidence that SilentAir is a highly sophisticated, state-level actor, given the complexity and nature of the attacks. This operation represents a serious escalation in cyber espionage, moving beyond targeting individual devices to compromising the foundational networks that millions of people rely on for daily communication.

The technical mechanism behind the SilentAir campaign is what makes it particularly alarming. Instead of using malware on a target's phone or employing social engineering tactics like SIM swapping, the attackers gain direct access to the mobile network operator's equipment. By compromising these core systems, they can monitor and intercept traffic as it is being routed through the network. This means they can read SMS messages, including one-time passwords for two-factor authentication (2FA), before they are even delivered to the recipient's device. This method is exceptionally stealthy and effective, as it leaves no trace on the end-user's phone and bypasses all device-level security measures. The user has no way of knowing their communications are being monitored or that their security codes have been stolen in transit.

This attack fits into a broader and more worrying trend of adversaries targeting critical infrastructure and supply chains. Rather than pursuing thousands of individual targets, state-sponsored groups are increasingly focusing on single points of failure that provide access to a vast number of potential victims. The compromise of a telecommunications provider is a prime example of this strategy. It also serves as a stark, real-world demonstration of a long-held concern within the security community: the fundamental insecurity of SMS as a channel for authentication. For years, experts have warned that SMS was not designed for security and is vulnerable to interception. The SilentAir campaign moves this from a theoretical risk to an active, documented threat orchestrated by a capable nation-state actor, with clear geopolitical motivations.

For CTOs, developers, and security leaders, the emergence of SilentAir is a powerful and urgent call to action. The key takeaway is that reliance on SMS for any form of secure communication, especially for authentication, is no longer a tenable security posture. This incident should accelerate the migration away from SMS-based 2FA toward more robust alternatives. Teams should prioritize implementing and encouraging the use of authenticator apps (TOTP), hardware security keys (like FIDO2/WebAuthn), and secure push notifications. While these methods are not completely immune to all attacks, they are significantly more resilient to the type of network-level interception demonstrated by SilentAir. Businesses must now re-evaluate their entire authentication stack and user security workflows, assuming that the underlying communication channels themselves can be hostile and compromised.

This attack bypasses endpoint security entirely by compromising the carrier network itself. For developers and security teams, it proves that SMS-based 2FA is a critically flawed authentication method, as messages can be intercepted before ever reaching the user's device, rendering it useless against a sophisticated actor.

Companies relying on SMS for user authentication or communication face a severe security risk. This type of breach can lead to mass account takeovers, data theft, and a complete loss of customer trust, potentially resulting in significant financial and reputational damage.