SS7 Attacks Explained: How Phone Network Flaws Track Locations and Why SMS 2FA Is Weak

Researchers at the University of Toronto's Citizen Lab have documented surveillance operators abusing the phone network itself to track where people's phones are, without hacking the phone or the person's accounts. If your business still protects email, banking or payroll logins with text-message codes, this is a good reason to move those accounts to something stronger.

The report came out in April 2026, but its lesson has not changed: the cellular network was built on trust between carriers. This post covers what the research confirmed and what it did not, and the changes a business can make this week.

What are SS7 and Diameter?

SS7 (Signalling System No. 7) and Diameter are the signaling systems carriers use to talk to each other behind the scenes. When a phone roams onto another network, gets a text or takes a call, these messages tell the networks where the subscriber is and how to route the traffic. Citizen Lab describes SS7 as the 3G signaling protocol and Diameter as its 4G counterpart.

Both depend on trust between operators. A request that arrives from what looks like a legitimate connected carrier is generally answered, and some of those answers reveal location.

What Citizen Lab confirmed

The report, "Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors" by Gary Miller and Swantje Lange, was published April 23, 2026. It draws on telemetry from the signaling security company Cellusys and describes two actor clusters, called STA1 and STA2.

STA1 ran long-term location tracking. In one campaign on November 25, 2024, it targeted a subscriber that a Middle East operator had flagged as a "VVIP." Over about four hours it switched back and forth between SS7 and Diameter and rotated its requests through eleven operator identities in nine countries. The telemetry ties more than 500 threat events to STA1 since November 2022.

STA2 combined three techniques in one attack on February 11, 2025: SS7 reconnaissance, a hidden SMS aimed at the victim's SIM card, and Diameter location queries. The SMS was a SIMjacker-style exploit. It was built to be invisible to the phone's owner and to make the SIM report the phone's location without any action from them. In this case, the operator's signaling firewall blocked the messages. The address that sent them was linked to more than 1,700 other SS7 attacks between October 2023 and April 2025, and over 92% of those were location tracking.

Across both clusters, the attackers used identifiers tied to operators in 17 places, including the UK, Israel, Sweden, Italy, Switzerland and Jersey.

Why this works: not a bug

The report says it plainly: "These vulnerabilities are not the result of software bugs or network misconfigurations." The weaknesses are built into how global telecom is designed and how the industry does business. The actors used legitimate operator signaling identities and trusted connections between carriers. The researchers say weak screening of that traffic between carriers made things worse, but they call the core issue a failure of legacy trust models and oversight, not a single carrier's mistake.

So there is no patch you can install on a phone to fix this.

Who is behind it

The authors do not attribute the activity to a specific government or organization. They say the indicators point to a likely explanation: "a commercial surveillance platform supporting state-sponsored intelligence activities." In other words, the operators appear to be commercial vendors, and their customers appear to be government intelligence services.

What is not known

• The report does not identify the people who were targeted, or say how many tracking attempts succeeded.
• The report covers location tracking. It does not document anyone stealing two-factor codes in these campaigns.
• It does not cover 5G networks.

Can SS7 attacks intercept SMS 2FA codes?

This is where the issue reaches ordinary business accounts. The Citizen Lab research did not cover code theft, but CISA's Mobile Communications Best Practice Guidance, dated December 18, 2024, speaks to it directly. CISA's advice: "Do not use SMS as a second factor for authentication." It explains that SMS messages are not encrypted and that a threat actor with access to a telecom provider's network who intercepts them can read them. CISA wrote the guidance for highly targeted people after Chinese government-affiliated actors broke into commercial telecom infrastructure, but it says the guidance applies to all audiences.

Together, the two sources make the point. Citizen Lab shows that outsiders can get trusted access to carrier signaling. CISA warns that anyone with that kind of access can read text messages. A text message is not a safe place to send the key to your accounts.

SS7 attack vs SIM swap: what is the difference?

A SIM swap needs no signaling access. The attacker talks a carrier into moving your number to a SIM card they control, and from then on your calls and texts go to them. The route is different but the result is the same: your login codes reach someone else. CISA recommends setting a PIN or passcode on your mobile carrier account and adding MFA to that account.

Why it matters for a business

• Account takeover. Admin accounts for Microsoft 365 or Google Workspace, online banking, payroll, your domain registrar and your hosting provider often still accept SMS codes, either as the main second factor or as a recovery option.
• Location exposure. Executives, staff who travel and anyone handling sensitive deals are the kind of people this surveillance is aimed at.
• Your own customers. If your website or app sends login codes by text, your customers carry the same risk. Offering passkeys or an authenticator app is part of hardening a site properly.

What to do this week

SS7 attack questions people are asking

Can someone track my phone with just my number?

Citizen Lab documented surveillance actors locating phones through carrier signaling without touching the device. It took access to the signaling network, and the cases described were aimed at specific people.

Is SMS two-factor authentication still safe?

CISA advises against using SMS as a second factor. Where a service offers passkeys, security keys or an authenticator app, switch to one of those and turn SMS off.

Does a VPN or antivirus stop SS7 attacks?

No. These requests travel between carriers, not through your phone's internet connection. CISA separately advises against personal VPNs.

What is SIMjacker?

It is an attack that sends a hidden SMS command to the SIM card. In the STA2 case, the command was meant to make the SIM report the phone's location without the owner seeing anything.

Does 5G fix SS7 problems?

The report does not cover 5G. It shows attackers switching between 3G and 4G signaling, so a newer protocol does not close the gap while older ones are still in use.

The bigger lesson

No business can fix the global phone network. What you can control is whether your logins depend on it. Text-message codes rely on a network that was built on trust between carriers. Passkeys and security keys do not. Moving your most important accounts off SMS is one of the cheapest security upgrades available.

Want help moving your logins off SMS? See security hardening or request a quote.

Get security alerts by email, plus our free checklist, at /security-alerts.

Sources: Citizen Lab, Bad Connection; CISA, Mobile Communications Best Practice Guidance.