Most accounts treat a texted code as proof that the right person holds the right phone. A report published on November 11 by Enea, a Stockholm-based telecom software and security company, describes a threat actor that sits inside mobile operator networks and arranges for those texts to arrive somewhere else first. For some targeted subscribers, Enea observed two-factor authentication codes being intercepted immediately after the interception was switched on.
The actor is new, the mechanism is old, and the lesson is architectural: a code delivered by SMS is only as trustworthy as the least trustworthy operator in the chain that carries it. That chain is longer than most people assume.
What Enea actually reported
The primary source is Enea's research blog, "The Enemy Within," updated November 12. Two secondary reports, from The Hacker News and SecurityWeek on November 13, summarize the same document. None of the three names the compromised operators, the countries involved, or any target.
Enea names the new actor SilentAir and assesses with high confidence that it is state-level rather than a criminal group or a commercial surveillance company. The further claim, that its activity aligns with China-nexus operations, is made explicitly with low confidence. The stated reasons: Taiwan is the primary target while Chinese networks and subscribers are conspicuously not targeted; attack timing follows a UTC+8 working day with weekend lulls and pauses around Chinese holidays; and some targets were political and government VIPs. Those are indicators, not proof, and the report treats them that way.
The scale is meaningful but bounded. Enea identified suspicious SilentAir network elements inside operators in at least six Asian countries, and observed attacks aimed at a dozen more countries and territories, mostly in Southeast and East Asia, at times reaching East Africa, Central Asia, the Middle East, and Europe. Attacks came in bursts: sometimes a handful of subscribers, sometimes several thousand over a month, separated by gaps of up to several months. Enea says it has tracked the activity since early 2025, with suspicious traces from before that, and that it informed the infected operators. It believes SilentAir has been disrupted "for now."
The interception is a lie the network believes
The core technique does not touch the victim's phone. Mobile networks decide where to deliver your calls and texts based on which network element currently claims to serve you. SilentAir's compromised nodes sent the target's home network an UpdateLocation message, or its Diameter equivalent, asserting that the hacked equipment was now the serving node. When the home network accepted the claim, incoming calls and SMS were diverted through equipment the attacker controlled.
No malware on the handset, no phishing page, no SIM swap at a carrier store. The network's own routing logic, built on mutual trust between operators, does the work. Enea confirmed the compromise was internal by observing equipment inside one operator both send and receive the attack commands, rather than an outsider spoofing addresses.
The targeting profile is what separates espionage from the ordinary signalling abuse that surveillance companies generate. In Enea's comparison, interception made up 18.3% of SilentAir's activity against 2.1% for a typical surveillance firm, while location tracking, the surveillance industry's main product, was nearly absent at 0.22% against 30.9%. SilentAir was not watching where people were. It was taking what was addressed to them.
Silent SMS as a test harness
The largest share of SilentAir's activity, about 74%, was something else: silent SMS, messages that arrive without any display or alert on the phone. The pattern is instructive. During the day, silent texts went mostly to subscribers on other networks, apparently to test whether a diversion was active: if the message landed on the compromised node instead of the handset, interception was confirmed. At night, high volumes went to Taiwanese subscribers, plausibly a bulk re-check, since phones are least likely to re-register to their real location while their owners sleep.
Two operational details show care. The messages were submitted through an interim operator's SMSC rather than sent directly, obfuscating their origin. And they carried text: bland motivational lines in slightly off English. Enea's explanation is that an interim system can strip the silent flag, rendering the message visible, and spam-like filler makes the recipient dismiss it instead of asking questions. Even the cover story had a cover story.
The tooling is converging on what defenders watch least
The same report documents LIMINAL PANDA, a separate, previously known actor, evolving in the opposite direction. Its GTPDoor backdoor, first documented in February 2024, hid commands in GTP-C, the control protocol that sets up data connections between operators. Enea detected and blocked that traffic at several customer operators from the first quarter of 2026, saw infections or strong signs of them at five to ten operators, and estimates several dozen may be affected globally. It then found a new version, GTPDoor v3, that hides in GTP-U, the protocol that carries user data itself. GTP-U traffic is orders of magnitudes higher in volume, harder to inspect, and historically treated as less exploitable, so it received less defensive investment. It also survives into 5G, which GTP-C does not.
A third piece of tooling connects the two worlds. Singapore's IMDA describes SIGweaver, a kernel-level Linux driver attributed to LIMINAL PANDA with moderate confidence, which injects SS7 and Diameter messages into existing legitimate signalling flows without opening new connections, and overwrites intercepted responses with errors so network components see noise instead of evidence. Enea considered whether SilentAir used this tool and concluded the known version cannot explain what it observed: SilentAir's nodes answered transactions they had not initiated, something the documented tool strictly refuses to do. The link between SilentAir and LIMINAL PANDA remains, in Enea's own words, possible but unconfirmed.
What this does to the texted code
Authentication standards have been cautious about SMS for years, and the current NIST digital identity guidelines show why in measured language. Out-of-band authentication over the public telephone network is a restricted case: verifiers must offer alternative authenticator types, codes must be short-lived and single-use, and the whole out-of-band family is described as not phishing-resistant. The SilentAir report adds a different weakness to that list, one that no user behavior fixes. When the attacker operates inside the signalling network, the "separate channel" the code travels on is the attacker's infrastructure. The phone in the right person's pocket simply never rings.
The practical conclusion for anyone building or running authentication is not that SMS codes are useless; they still stop far more than they cost. It is that they are the floor, not the ceiling. Where accounts protect anything an intelligence service would want, passkeys, authenticator apps, or hardware keys should be the default and SMS at most a fallback, because the threat model now includes the delivery network itself.
What is not established
Discipline matters here. Enea is a vendor of signalling firewalls, and its visibility runs through its own customer deployments; its estimate of several dozen infected operators is an extrapolation, labeled as such. The China-nexus attribution is low confidence. The report presents no evidence that voice calls were intercepted with the same success as texts, and none that any specific account was taken over with a stolen code. Enea also could not recover or analyze the malware it believes SilentAir used. These gaps belong in any honest summary, because the architectural lesson stands without exaggerating the incident.
Enea's recommendations to operators: deploy GTP-C and GTP-U firewalls that share information with SS7 and Diameter defenses, treat the entire interconnect as untrusted, watch signalling protocols inside the network, and integrate signalling security with the rest of IT security. Access to any one of the world's 800-plus mobile operators, the report warns, is access to all of them through the interconnect. Your verification code rides that interconnect every time it is sent. It is worth remembering who else can be listening.
Sources: Enea, "The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks" (Nov 11, 2026, updated Nov 12); The Hacker News (Nov 13, 2026); SecurityWeek (Nov 13, 2026); Singapore IMDA advisories on SIGweaver (Jan 2026) and LIMINAL PANDA (Nov 2024); NIST SP 800-63-4, out-of-band authentication requirements.
