Is SMS 2FA Safe? What the SilentAir Attacks Show

Is SMS 2FA safe?

SMS two-factor authentication is better than a password alone, but it is the weakest common second factor, because the text travels through phone networks that can be attacked ^[2][3][4].

Two-factor authentication (2FA) means a login needs something besides your password, such as a one-time code. When that code arrives by text message (SMS), anyone who can redirect or read your texts can also get the code.

The US Cybersecurity and Infrastructure Security Agency (CISA) says plainly: "Do not use SMS as a second factor for authentication," in guidance written for highly targeted individuals ^[2]. Its reasons: SMS messages are not encrypted, a threat actor with access to a telecom provider's network can read them, and SMS is not phishing-resistant ^[2].

The US National Institute of Standards and Technology (NIST) treats codes sent over the public telephone network, meaning SMS or voice, as its one "restricted" authenticator, which organisations may use only after accepting the extra risk and offering an alternative ^[4].

For most people the practical answer is: keep SMS 2FA rather than having no 2FA, since CISA says any form of MFA is better than none ^[3], but move important accounts to a stronger method. The Pouyam guide Two-Factor Authentication Explained: Which 2FA Method Is Safest? compares all the options.

What is SilentAir?

SilentAir is the name Enea, a telecom security company, gives to a newly identified threat actor that it says attacks mobile subscribers through compromised parts of mobile networks ^[1][5].

Enea published its findings on 11 November 2026 (updated 12 November) in a report that also covers a separately tracked group, LIMINAL PANDA ^[1]. Key points, all according to Enea ^[1]:

• Enea has tracked unusual signalling attacks from some Asian mobile operators since early 2025, with suspicious activity found from before that.
• It found SilentAir-related network elements in mobile operators in at least six Asian countries, with others suspected but not confirmed.
• From these, attacks targeted mobile operators and subscribers in a dozen more countries and territories. Taiwan was the primary target.
• Some targets were VIP individuals in the political and government domain.
• Enea assesses with high confidence that SilentAir is a state-level actor rather than a criminal group or a commercial surveillance company.

On who is behind it, Enea's wording is cautious: it assesses with low confidence that SilentAir's activity aligns with China-nexus cyber operations, citing the Taiwan focus, the absence of Chinese targets and attack timing that matched a UTC+8 working day ^[1]. Enea says a link with LIMINAL PANDA is possible but unconfirmed ^[1]. SecurityWeek's report on the research describes the same assessments ^[5].

How were SMS codes intercepted?

Enea says SilentAir sent malicious location-update messages over the SS7 and Diameter signalling systems so that a target's incoming calls and texts were routed through a node the attacker controlled ^[1][5].

Mobile operators exchange signalling messages so that phones can roam and receive calls and texts anywhere. Older networks use SS7 (2G and 3G), 4G uses Diameter, and 5G uses HTTP/2-based protocols, Enea explains ^[1]. Enea calls the trust between operators essential for global roaming but also an attractive environment for attackers ^[1].

According to Enea ^[1]:

• SilentAir used commands such as SS7 UpdateLocation and Diameter Update-Location-Request to change a target's registered location, so later SMS and calls of interest would be intercepted.
• Enea observed 2FA codes being received directly after the moment of interception for some targets.
• The attacks came from compromised network nodes inside infected operators, not from outside spoofing.
• SilentAir made very large-scale use of silent SMS, texts that are not displayed on the handset and do not generate an alert. Most of the traffic around midnight, when activity spikes, was aimed at Taiwanese subscribers. Enea says daytime messages, mostly to subscribers on other networks, seem to test whether earlier interception had worked, while the purpose of the night-time traffic is not confirmed.

This kind of attack happens inside the phone network. According to Enea, the attacks come from compromised nodes inside operator networks, not from your handset, so the practical defence for an individual is to stop relying on SMS for important logins ^[2].

Which 2FA method is safest?

Phishing-resistant methods based on FIDO standards, such as security keys and passkeys, are the strongest; authenticator apps come next; SMS and voice codes are the weakest ^[2][3].

CISA calls phishing-resistant multi-factor authentication "the gold standard" and lists FIDO/WebAuthn authentication among the phishing-resistant options ^[3]. Its fact sheet says SS7 and SIM-swap attacks are not applicable to phishing-resistant MFA or to app-based one-time codes, while SMS and voice are the weakest category ^[3].

CISA's mobile guidance adds detail ^[2]:

• Hardware FIDO security keys are the most effective; FIDO passkeys are an acceptable alternative.
• Authenticator-app codes are better than SMS but can still be phished.
• Only FIDO authentication is phishing-resistant.

The FIDO Alliance describes a passkey as a FIDO-based credential stored on your phone, computer or a hardware security key, unlocked the same way you unlock the device, such as with a fingerprint or PIN ^[6]. NIST explains that manually typed codes, from SMS or apps, are not phishing-resistant because a fake site can pass them on to the real one ^[4].

The table below summarises the main options.

How do I switch from SMS 2FA to something safer?

Add a passkey or security key to your most important accounts first, then an authenticator app elsewhere, and finally turn SMS off where you can ^[2].

1. List your key accounts. CISA advises taking an inventory of valuable accounts, including email and social media, and enrolling each in FIDO-based authentication, especially Microsoft, Apple and Google accounts ^[2]. Your email matters most, because it can reset other passwords.
2. Add a passkey or security key. In each account's security settings, look for passkeys, security keys or 2-step verification. Passkeys are supported in all major operating systems and browsers, the FIDO Alliance says ^[6].
3. Use an authenticator app where passkeys are not offered. CISA names free apps such as Google Authenticator, Microsoft Authenticator and Authy for less valuable accounts ^[2].
4. Turn SMS off afterwards. CISA warns that enrolling in an app does not automatically remove SMS, which leaves "a weak, exploitable fallback" ^[2].
5. Save recovery codes offline in a safe place, so losing your phone does not lock you out.
6. Use a password manager to keep passwords long and unique; CISA recommends this too ^[2].

CISA notes that some services may still fall back to SMS during account recovery, so removing SMS completely may not be possible everywhere ^[2]. For how passkeys work, see the Pouyam guide What Are Passkeys? How Passwordless Sign-In Works and Why It Is Safer.

Who is most at risk from SMS interception?

In Enea's findings, SilentAir targeted some political and government VIPs, and its attacks ranged from a single subscriber or a few to several thousand subscribers over a month ^[1].

Enea says attacks came in bursts, with gaps of up to several months or longer, and that SilentAir nodes in different infected networks in different countries co-ordinated against high-value, VIP-type targets ^[1]. Enea says surveillance companies account for the overwhelming majority of attacks on signalling interfaces; in its breakdown, interception made up 18.30% of SilentAir's activity against 2.07% for a typical surveillance company, so SilentAir stood out for its share of interception ^[1].

CISA's guidance was written for "highly targeted" individuals in senior government or political positions ^[2]. Anyone who handles sensitive information has reason to take extra care.

Everyone else still benefits from moving away from SMS: SIM-swap attacks, in which an attacker convinces a carrier to transfer control of your phone number, also expose SMS codes, CISA says ^[3]. The same steps protect against both.

Remember that interception is only one route. Most account takeovers start with phishing, which the Pouyam guide What Is Phishing? How to Recognise Fake Emails, Texts and QR Codes explains.

What should mobile operators do?

Enea recommends that operators secure every interconnect protocol together, treat the roaming interconnect as untrusted, and monitor signalling inside their own networks ^[1].

Enea's recommendations include ^[1]:

• Deploy GTP-C and GTP-U security firewalls and make them share information with SS7 and Diameter firewalls.
• Go beyond basic industry recommendations, which Enea says should be the start of signalling security, not the endpoint.
• Regard the IPX interface between operators as untrusted, with deeper analysis and firewalling of traffic across protocols.
• Analyse signalling protocols inside the network as well as at the edge.

Enea says it informed the SilentAir-infected operators of the malicious signalling sources in their networks and believes the group's footprint has been affected ^[1]. It also warns that the same techniques could be used by any other threat actor ^[1].

These are operator-level fixes. Individual users cannot see or control them, which is another reason to choose login methods that do not depend on the phone network.

Will SMS codes disappear?

Not immediately: NIST still allows SMS as a restricted option, but security agencies are steering people towards passkeys and other phishing-resistant methods ^[2][4].

NIST says it may adjust the restricted status of telephone-network authentication as threats and the network evolve, and requires providers that use it to offer at least one alternative and a migration plan ^[4]. CISA already tells highly targeted people to migrate away from SMS-based MFA ^[2].

The FIDO Alliance says passkeys can replace legacy flows such as password plus SMS code, and that passkeys are supported in all major operating systems and browsers ^[6].

This guide is for general security awareness. Facts about SilentAir come from Enea's own report as of 13 November 2026; Enea says it will update its blog if its assessment of a link between SilentAir and LIMINAL PANDA changes ^[1].