Wrong call: Beware of malicious SIM cards

The commands, in use since the 1980s, can reconfigure modems and open pathways for attackers. University of Birmingham researchers have revealed how compromised SIM cards can be weaponised to hijack smartphones, electric vehicle chargers. and other connected devices, exposing a critical new attack surface in modern communications. Presenting their findings at the 2026 USENIX WOOT Conference in Baltimore, the team demonstrated how a SIM feature known as Proactive SIM can be exploited to send AT commands directly to a device’s modem. SIM attacks These commands, in use since the 1980s, can reconfigure modems and open pathways for attackers. “The fascinating part here is that the proactive capabilities of a SIM and the resulting attack surface are explicitly defined in the technical specifications for cellular communication, resulting in ‘specification‑compliant’ attacks,” said Dr Marius Muench, Assistant Professor in Computer Science. Working with Tomasz Piotr Lisowski and Kristian Covic from IT security company Fuzzware, the researchers developed the CATana toolkit to explore SIM‑originating AT commands across 26 devices, including 18 smartphones and eight IoT modules embedded in EV chargers, industrial equipment, and connected cars. Risks The study uncovered multiple risks, including re‑enabling closed debug interfaces, exfiltrating sensitive identifiers, sending messages, forcing devices to downgrade from secure 4G to weaker 2G networks, shutting down devices, and disabling communications altogether. “Hostile SIMs are an overlooked attack vector, and it’s great that we could show this with our work,” Covic said. The team highlighted four attacker scenarios: remote exploitation of SIM software, physical replacement of SIMs, abuse of remote SIM management by compromised operators, and supply‑chain manipulation during manufacturing or distribution. Android devices They also discovered that on recent Android devices, a malicious SIM could force a locked phone to open an attacker‑controlled website without user interaction. “Other researchers, cybersecurity experts, and leaked intelligence documents have shown some of the dangers of hostile SIMs before us. Yet, the resulting risks have not been fully mitigated,” Dr Muench added. GSM association The researchers reported their findings to the GSM Association and affected manufacturers, prompting software updates and hardened configurations. “It was great working together with the affected companies and GSMA. Our reports were treated seriously, and key manufacturers made software updates and hardened configurations available to their customers,” Dr Muench said. “The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to public light and hope to cooperate with vendors and standardisation bodies to remedy the risks,” Lisowski noted. The issues identified by the researchers as part of their study are tracked under CVE-2025-48618, CVE-2026-57550, and CVE-2026-0122.