Subscriber Identity Modules (SIMs), secure elements used to connect devices to a mobile network, can pose severe security risks when compromised. A malicious SIM could allow attackers to gather information about a device, interfere with its connectivity and serve as an entry point for further cyberattacks.
Presenting their findings at the 2026 USENIX WOOT Conference on Offensive Technologies in Baltimore, University of Birmingham researchers reveal a new attack surface exposed to malicious and compromised SIMs.
A feature known as Proactive SIM allows a SIM card to send a limited number of special commands directly to a device’s modem. One allows the SIM to request the execution of so-called ATcommands—the same type of commands used to control and configure modems since the 1980s.
Tomasz Piotr Lisowski and Dr. Marius Muench worked with Kristian Covic from IT security company Fuzzware to develop the CATana toolkit to explore the dangers of SIM-originating AT commands across different devices.
How CATana exposed the risks
The researchers investigated 26 representative devices: 18 smartphones and eight cellular-connected IoT modules, including modules commonly embedded in electric vehicle chargers, industrial equipment and connected cars. The devices studied were not limited to any single manufacturer or operating system.
After identifying that several analyzed devices would execute SIM-originating AT commands, the researchers used CATana to demonstrate the threats posed by the resulting SIM AT interface, leading to the discovery of multiple security vulnerabilities. Example attacks enabled by the presence of a SIM AT interface include:
Re-enabling closed-down debug interfaces;
Exfiltrating sensitive information, such as a device’s unique identifier;
Sending messages or initiating calls;
Obtaining arbitrary command execution capabilities on a victim’s communication processor;
Forcing a device to downgrade from secure 4G connectivity to older and less secure 2G networks;
Shutting down the victim device; and
Disabling cellular communications altogether.
Muench, assistant professor in computer science at the University of Birmingham, said, “The fascinating part here is that the proactive capabilities of a SIM and the resulting attack surface are explicitly defined in the technical specifications for cellular communication, resulting in ‘specification-compliant’ attacks.”
“Other researchers, cybersecurity experts and leaked intelligence documents have shown some of the dangers of hostile SIMs before we did. Yet, the resulting risks have not been fully mitigated. Potentially, this is because hostile SIMs are not included in most threat models, although we are slowly seeing a promising shift here.”
Four paths to a hostile SIM
Building on their earlier work, the research team highlights four attacker scenarios leading to malicious or compromised SIMs and eSIMs, supported by precedents from real-world incidents:
Remote attackers exploiting vulnerabilities in SIM software;
Physical attackers replacing a victim’s SIM card or installing a hardware implant;
Compromised operators abusing remote SIM management features; and
Supply-chain attackers modifying SIMs during manufacturing or distribution.
The researchers point out that the risks of SIM-originating AT commands are especially relevant for IoT devices such as industrial equipment, vehicle systems or routers, as these are often locked down with only a limited number of exposed interfaces. The presence of a SIM AT interface could, therefore, serve as an unforeseen entry point for further compromising the victim device.
The study also comments on the more general risk of proactive SIMs, which can turn victim devices into surveillance tools. During the work leading up to the publication, the researchers discovered that, on recent Android devices, a malicious SIM could force the phone to open an attacker-controlled website without any user interaction, even when the phone was locked.
The researchers argue that many proactive SIM features are legacy technologies built only with benign SIMs in mind. However, as technology and the threat surface evolve, many features are no longer needed and create unnecessary security risks.
Covic said, “At Fuzzware, we are very happy that we could support this research project. Hostile SIMs are an overlooked attack vector, and it’s great that we could show this with our work.”
Vendors begin hardening devices
The researchers did not stop at finding the vulnerabilities. They also reached out to the GSM Association (GSMA), as well as affected chip and device manufacturers, to address the identified issues.
Muench reflected: “It was great working together with the affected companies and GSMA. Our reports were treated seriously, and key manufacturers have made software updates and hardened configurations available to their customers. This will benefit billions of future SIM-enabled devices operating worldwide, including smartphones, connected vehicles, payment terminals, routers, critical infrastructure and EV charging systems.”
Asked about future research, Lisowski said, “The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to the public eye and hope to cooperate with vendors and standardization bodies to remedy the risks in today’s and future devices.”
The issues identified by the researchers as part of their study are tracked under CVE-2025-48618, CVE-2026-57550 and CVD-2026-0122. https://techxplore.com/news/2026-08-malicious-sim-cards-hijack-smartphones.html
Recent Comments