Security researchers from Birmingham University unveiled research at USENIX WOOT Conference 2026 on Offensive Technologies, demonstrating how a SIM card vulnerability, including vulnerabilities affecting eSIM cards, could allow attackers to secretly take control of smartphones, EV chargers, and cellular-connected Internet of Things (IoT) devices.
The research uncovered a previously overlooked security risk in older features that are still used in modern cellular devices.
Technical Breakdown: The Proactive SIM Exploitation
The vulnerability centers on a standardized feature known as Proactive SIM. Built into SIM cards to allow mobile network operators to interact directly with a device’s cellular modem, the feature permits SIMs to issue low-level commands.
- Modem AT Commands: Using the custom-built CATana testing toolkit, researchers Tomasz Piotr Lisowski, Dr. Marius Muench, and Kristian Covic (Fuzzware) discovered that malicious SIM cards can abuse the Proactive SIM interface to issue AT commands—the underlying control language used for cellular modems since the 1980s.
- Bypassing OS Protections: Because AT commands execute at the hardware/modem level, they operate completely outside the visibility and control of primary mobile operating systems like Android or iOS.
- Zero-Interaction Hijacking: A hostile SIM card—inserted physically or pushed via a compromised eSIM profile—can force a locked smartphone or IoT device to perform actions without any user interaction or on-screen notification.
Tomasz Piotr Lisowski said in research:
The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to the public light and hope to cooperate with vendors and standardization bodies to remedy the risks in today’s and future devices.
Scope & Affected Devices
The research team tested 26 devices, including 18 smartphones across multiple major manufacturers and operating systems, as well as 8 cellular-connected IoT modules.
1. Smartphones: Locked Android and iOS devices were forced to execute arbitrary web requests, open attacker-controlled browser destinations, and leak device telemetry.
2. Connected Infrastructure & EV Chargers: Cellular modules embedded in electric vehicle (EV) charging stations, industrial control equipment, and connected vehicles responded to SIM-originating AT commands. In these environments, compromised SIMs could serve as a bridgehead to pivot deeper into critical OT (Operational Technology) networks.
Industry Response & Mitigations
Historically, cellular threat models assumed that the SIM card was a trusted root of trust, controlled exclusively by mobile network operators. However, the USENIX WOOT paper argues that compromised telecom infrastructure or physical tampering with devices can turn malicious SIM cards into a real-world security threat.
- Modem Firmware Filtering: Cybersecurity experts are urging modem chip manufacturers (such as Qualcomm, MediaTek, and Samsung System LSI) to implement strict input validation and access controls for SIM-originating AT commands.
- Refining Threat Models: The researchers recommend that smartphone OEMs and IoT vendors restrict Proactive SIM capabilities by default and remove support for legacy AT command execution over internal interfaces.
