SilentAir Spies Hijack Phone Networks to Steal Text Messages and 2FA Codes Across Asia

A sophisticated spying group dubbed SilentAir has been caught using compromised equipment inside Asian telecom networks to intercept calls and text messages, primarily targeting users in Taiwan. The attackers exploited the trusted SS7 and Diameter signaling protocols that mobile operators use to route traffic, sending fraudulent location-update messages to divert specific users' communications. Security firm Enea discovered the campaign originating from at least six Asian countries and assessed with high confidence that it's a state-level operation, though it only linked the activity to China with low confidence.

The interception attacks were particularly focused on stealing two-factor authentication (2FA) codes immediately after diversion, suggesting attempts to break into victims' other accounts. While Enea says SilentAir has been disrupted for now, the compromised equipment may still exist within operator networks. This incident highlights the ongoing vulnerability of global telecom infrastructure to nation-state espionage and the risks to both individual privacy and account security when fundamental network protocols can be manipulated.