Malicious SIM Cards: 9 Ways They Can Hijack Your Digital Devices

Malicious SIM cards are turning out to be a far bigger threat than most people ever imagined. For decades, the tiny chip that connects your phone to a mobile network has been treated as a passive, trustworthy component. New research from the University of Birmingham, working with the security firm Fuzzware, shows that assumption was wrong. A SIM card isn’t just a way to authenticate you to a network. It can also send direct commands to your device’s modem, and if that SIM is compromised or built with bad intentions, those commands can do real damage.

Using a custom testing toolkit called CATana, researchers examined 26 devices, including 18 smartphones and eight cellular-connected IoT modules found in electric vehicle chargers, industrial routers, and connected cars. What they found was unsettling: a legitimate, decades-old feature of the cellular standard could be abused to steal data, force devices onto insecure networks, shut hardware down remotely, and in some cases run arbitrary attacker code, all without the user clicking, tapping, or noticing anything at all.

This isn’t science fiction or a theoretical exploit buried in a lab. It was demonstrated on commercial products already in people’s homes, cars, and garages. In this article, we’ll break down exactly how malicious SIM cards work, which devices are exposed, why this problem has stayed hidden for so long, and what you can actually do to protect yourself.

What Is Proactive SIM and Why It Matters

To understand how malicious SIM cards can hijack a device, you first need to understand a feature called Proactive SIM. Most people assume a SIM card is a one-way street: your phone asks it questions (like “what’s the subscriber ID?”) and the SIM answers. Proactive SIM flips that relationship. It allows the SIM card itself to initiate communication and send a limited set of special commands directly to the device’s modem.

This isn’t a hidden backdoor or a bug someone introduced by accident. Proactive SIM has been part of the official cellular specifications for years, built for legitimate purposes like carrier menus, network configuration updates, and location-based services. The problem is that one of the commands available through this channel, known as RUN AT, allows the SIM to request execution of an AT command on the modem.

AT commands are the control language that modems have used since the 1980s to manage calls, texts, network settings, and more. They were never designed with a hostile SIM card in mind, because nobody expected the SIM itself to become the attacker. That assumption is exactly what this research overturns.

How Malicious SIM Cards Take Control of Modems

The RUN AT Command Explained

The RUN AT instruction is the core of this whole attack surface. Once a SIM card issues this command, the modem treats it the same way it would treat a command coming from trusted software on the device. There’s no separate authentication step asking whether the SIM should really be allowed to do this. If the modem accepts AT commands from the SIM interface at all, a malicious SIM card can use that trust to its advantage.

Depending on which AT commands a specific modem accepts, this can allow an attacker to:

• Read sensitive hardware identifiers, such as the IMEI or IMSI
• Force the device to send text messages or make calls
• Shut the modem down or power off the entire device remotely
• Downgrade the network connection to older, less secure standards
• Trigger the device to open a specific URL, even while locked
• In the most severe cases, achieve code execution on the modem or the broader system

CATana: The Toolkit That Exposed the Flaw

To systematically test how far this problem goes, researchers Tomasz Piotr Lisowski and Dr. Marius Muench, together with Kristian Covic from Fuzzware, built a toolkit called CATana. It was designed specifically to explore the risks posed by SIM-originating AT commands across many different kinds of hardware.

Rather than testing a single phone model or a single chipset, the team ran CATana against a broad, representative mix of devices: everyday consumer smartphones from multiple manufacturers, and cellular IoT modules of the kind embedded in machines that most people never think about as “connected,” like EV chargers and industrial control equipment. That breadth is what makes the findings so significant. This isn’t a niche flaw in one obscure product. It’s a structural issue in how modems and SIM cards are designed to interact.

Real-World Attacks Researchers Demonstrated

Smartphones Under Threat

Out of 18 smartphones tested, three accepted the RUN AT command: the OPPO Find X5, the OPPO Reno 14 F 5G, and the ASUS Zenfone 9. Notably, no iPhone or Pixel device in the test group was vulnerable to this specific command, which suggests that some manufacturers have already hardened their modem configurations against SIM-originated instructions.

On the OPPO Reno 14 F 5G specifically, researchers found that the device accepted close to 200 different AT commands and variants through the SIM interface. That included commands capable of powering the phone off, halting its modem, or forcing it onto a weaker, older network. Perhaps the most alarming discovery was that on some recent Android devices, a malicious SIM card could force the phone to open an attacker-controlled website with zero user interaction, even while the screen was locked. That means a phone sitting untouched on a table could still be manipulated into visiting a malicious page in the background.

EV Chargers and IoT Devices at Risk

Smartphones weren’t the primary casualty in this research. Cellular IoT modules, the kind that power machine-to-machine communication in vehicles, chargers, and industrial systems, were even more exposed. Six of the eight IoT modules tested accepted the RUN AT command, compared to just three of 18 phones.

One especially concerning example involved an AUTEL EV charger built around a Quectel EC25-AFX cellular module. Commands issued through the SIM interface triggered a command injection vulnerability in the modem’s Linux-based application processor, giving researchers full code execution on the module. In other words, a compromised SIM card inserted into a public or home EV charger could, in theory, let an attacker run their own software on a piece of physical infrastructure that people plug their cars into every day.

Other affected hardware included modules pulled from an industrial router and a car’s telematics control unit, several of which were built around Quectel components. This tells us the risk extends well beyond consumer electronics and into critical, real-world infrastructure that people rely on without a second thought.

Downgrading Networks to 2G

One of the more subtle but dangerous capabilities researchers demonstrated was network downgrading. Using SIM-issued commands, they were able to force a phone’s connection down to 2G, an older cellular standard that lacks proper network-to-device authentication. Once a device is locked onto 2G, it becomes far more vulnerable to rogue base stations that impersonate legitimate cell towers, a technique sometimes used for surveillance or interception.

What made this particularly troubling is that the downgrade persisted even after researchers tried standard countermeasures: enabling airplane mode, disabling the SIM, and manually changing the phone’s network settings. The connection stayed locked to the weaker standard regardless. This shows that once a malicious SIM card has issued the right command, undoing the damage isn’t always as simple as a quick settings change.

Which Devices Were Most Vulnerable

To summarize the scope of what researchers found across the 26 devices tested:

1. Nine of the 26 devices (phones and IoT modules combined) had the RUN AT command enabled and reachable through the SIM interface.
2. Six of eight cellular IoT modules accepted the command, a much higher rate than smartphones.
3. Three of 18 phones were affected: the OPPO Find X5, OPPO Reno 14 F 5G, and ASUS Zenfone 9.
4. No iPhone or Pixel device in the test set accepted the vulnerable command.
5. Five of the six vulnerable IoT modules used Quectel chipsets, pulled from an EV charger, an industrial router, and a connected car’s telematics unit.
6. One AUTEL EV charger allowed full code execution through a command injection flaw reachable via the SIM.
7. At least one phone accepted close to 200 distinct AT commands and variants through its SIM interface.
8. Network downgrade attacks proved persistent, surviving airplane mode and manual network setting changes.
9. A malicious SIM could open attacker-controlled URLs on some Android phones without any user interaction, even when locked.

How Attackers Could Get a Malicious SIM Into Your Device

It’s worth being clear about the practical side of this threat, since the word “hijack” can sound more dramatic than the delivery method actually is. Researchers pointed to a few realistic paths by which a hostile SIM could end up connected to a device:

• Supply-chain tampering during manufacturing, where a compromised SIM or SIM profile is introduced before a device ever reaches a customer
• Rogue or malicious cellular operators, including small or unofficial mobile virtual network operators that issue SIMs with hostile configurations
• Compromised software updates pushed to a SIM’s own operating environment, since modern SIMs run their own small applications
• Physical access, where an attacker swaps or inserts a prepared SIM card into a target device, such as a shared or public EV charger

This means the risk isn’t limited to someone stealing your phone and slipping a bad SIM inside it. Devices that accept SIMs from third parties, like fleet vehicles, shared EV chargers, or industrial sensors on a cellular data plan, are arguably at greater risk because the SIM supply chain for those devices is often less tightly controlled than it is for a personal smartphone bought from a carrier store.

Why This Attack Surface Has Gone Unnoticed for Decades

The researchers made an important point about why this issue has flown under the radar for so long: Proactive SIM and AT command support aren’t bugs. They’re legacy features, written into cellular specifications at a time when SIM cards were assumed to always be trustworthy. Nobody building the original standards anticipated a future where SIM cards themselves might be issued by hostile actors or compromised after the fact.

As the mobile ecosystem has grown to include billions of IoT devices, many of which sit unattended in public or semi-public locations, that founding assumption has quietly become outdated. A feature that made sense in an era of controlled, carrier-issued SIMs looks very different in a world where malicious SIM cards can be manufactured, purchased, or tampered with far more easily.

This gap between old assumptions and new realities is a recurring theme in cybersecurity coverage. The Hacker News reported on how a rogue SIM can order a device to run commands of the attacker’s choosing, enough in some cases to hand over full control of a cellular module. Help Net Security similarly traced the entire attack surface back to a legitimate function already built into the cellular specification, rather than a newly introduced flaw.

What Manufacturers and Carriers Are Doing About It

Following responsible disclosure practices, the research team notified affected chip manufacturers and device vendors before presenting their findings publicly at the 2026 USENIX WOOT Conference on Offensive Technologies in Baltimore. Some vendors have already released updates or hardened default configurations to restrict which AT commands a SIM interface can trigger. Others, particularly in the IoT and industrial equipment space, are still working through fixes given how many devices and chipset variants are affected.

The GSMA, the industry body responsible for maintaining global mobile standards, along with individual chipset makers like Quectel, are also expected to reassess how much trust a modem should automatically place in commands arriving from the SIM interface. Given that many of these proactive SIM features are decades old and rarely used for their original purpose anymore, some researchers argue the simplest long-term fix is to disable unnecessary AT command support at the modem level entirely, rather than trying to patch every possible misuse case individually.

How to Protect Yourself and Your Devices

While this research is aimed primarily at manufacturers and carriers, there are practical steps individuals and organizations can take while fixes roll out industry-wide:

• Keep your device software and modem firmware updated. Vendors that have issued patches typically deliver them through standard system updates, so staying current matters more than usual right now.
• Be cautious with SIM cards from unofficial sources. Cheap prepaid SIMs or SIMs from unfamiliar resellers carry more risk than ones purchased directly from a major carrier.
• Avoid inserting personal SIM cards into shared or public hardware, and be wary of any device, like a public charging station, that requires you to hand over a SIM or accept an unfamiliar one.
• Watch for unexplained network downgrades. If your phone unexpectedly shows a 2G or “E” connection indicator in an area where you’d normally get 4G or 5G, treat it as a warning sign worth investigating.
• For fleet operators and businesses using cellular IoT devices, review the SIM provisioning process with your vendor and ask specifically whether AT command access through the SIM interface has been restricted.
• For EV charger operators and manufacturers, prioritize firmware updates addressing this class of vulnerability, since chargers sit in public spaces and are natural targets for physical SIM tampering.

None of these steps make a device completely immune, since the underlying fix has to happen at the modem and chipset level. But they meaningfully reduce your exposure while the industry works through remediation.

Conclusion

The discovery that malicious SIM cards can hijack smartphones, EV chargers, and other connected devices is a reminder that even the most familiar, decades-old pieces of technology can hide serious blind spots. What makes this research stand out isn’t a single clever exploit, but the fact that the vulnerability sits inside a legitimate, specification-compliant feature that almost nobody thought to question. From forcing locked phones to open malicious links, to downgrading network security, to handing attackers full code execution on an EV charger’s internals, the CATana research shows just how much trust modems place in the SIM cards sitting inside them. As connected devices continue to multiply across homes, vehicles, and public infrastructure, closing this gap between old assumptions and modern threats needs to become a priority for chipmakers, device manufacturers, and carriers alike, not just an afterthought.