A new threat actor is exploiting privileged access in the SMS supply chain to intercept OTP codes and other messages.