A SIM card is not just a passive chip that stores your phone number — it is a small computer capable of issuing commands to your device. Researchers from the University of Birmingham and the security firm Fuzzware have demonstrated that a malicious or compromised SIM card can silently take control of smartphones, electric vehicle charging stations, and even industrial equipment. The root cause is not a software bug but a built-in feature of cellular standards called Proactive SIM, which allows the SIM card itself to send commands to a device’s modem using AT commands — a protocol dating back to the 1980s. The modem obeys these commands without notifying the device owner.
What you need to know
- Researchers tested 26 real devices (18 smartphones and 8 cellular modules in connected cars and EV chargers) and demonstrated silent exploitation via the SIM-to-modem interface.
- The attack exploits Proactive SIM, a standard feature of cellular protocols — not a coding error — which is why it was long overlooked in threat models.
- Demonstrated capabilities included running arbitrary code, stealing hardware identifiers, forcing a locked Android phone to open malicious URLs, downgrading connectivity from 4G to vulnerable 2G, and remotely disabling devices.
- Findings were disclosed to chipset makers, device vendors, and the GSMA, which have begun issuing patches and hardened configurations.
SIM cards are not as harmless as they seem and may already be working against you
Why a standard feature became a security threat
The findings were presented at the USENIX WOOT 2026 cybersecurity conference in Baltimore. The core issue is that Proactive SIM is a legitimate, standardized capability — not an accidental vulnerability. It allows a SIM card to instruct the device’s modem via AT commands, and the modem complies without seeking the user’s permission. Because SIM cards have almost never been included in device threat models, this attack surface went largely unexamined for years.
The source also notes that eSIM technology is not fully immune either, as it has its own weak points — though specific eSIM exploits were not detailed.
What the researchers demonstrated on real devices
The research team built a custom tool called CATana and tested it against 26 real-world devices from various manufacturers and operating systems: 18 consumer smartphones and 8 cellular modules embedded in connected vehicles and EV charging stations.
Device control can be hijacked without any action from the user
Through the SIM-to-modem interface, the researchers were able to control devices without any action from the device owner. Specifically, they demonstrated the ability to:
- Execute arbitrary code on the device;
- Steal unique hardware identifiers;
- Force a locked Android phone to open malicious URLs;
- Downgrade the cellular connection from 4G to the older and more vulnerable 2G standard;
- Remotely disable or completely shut down the device.
All of these were demonstrated on real hardware, not in a theoretical simulation. Such an attack could be difficult to detect, as it may produce only indirect signs of compromise.
The risk to EV chargers and connected infrastructure
The threat extends well beyond personal phones. Industrial routers, EV charging stations, and autonomous vehicle systems are typically hardened against attack — USB ports are locked down, remote firmware access is restricted. Yet according to the researchers, nearly all of them leave one entry point wide open: the SIM card slot.
EV chargers are protected on every side except the SIM card slot
An attacker does not necessarily need physical access to insert a rogue SIM. A compromised SIM could reach a device through several routes:
- An infected software update pushed to the SIM card itself;
- A dishonest carrier abusing remote SIM management platforms;
- A supply-chain substitution during manufacturing.
Industry response and what users can do
The researchers followed responsible disclosure practices: they privately shared their findings with chipset manufacturers, device vendors, and the GSMA industry association before any public presentation. Key industry players have begun releasing patches and hardened configurations to neutralize malicious AT commands.
The reason this class of attack went unnoticed for so long is straightforward: SIM cards were almost never considered a threat vector. The researchers say that attitude is now beginning to change across the industry.
For ordinary users, the practical advice is to install system updates as soon as they become available and avoid inserting SIM cards of unknown or suspicious origin into your devices. Until protective patches reach every smartphone and connected device, this attack vector cannot be fully ruled out.
The research underscores a broader lesson: dangerous vulnerabilities can hide not only in new technologies but also in legacy components that have gone unscrutinized for decades.
