Tomasz Piotr Lisowski and Dr Marius Muench worked with Kristian Covic, from IT security company Fuzzware, to develop the CATana toolkit to explore the dangers of SIM-originating AT commands across different devices.
The researchers investigated 26 representative devices: 18 smartphones and eight cellular-connected IoT modules, including modules commonly embedded in electric vehicle chargers, industrial equipment, and connected cars. Devices studied were not limited to any single manufacturer or operating system.
After identifying that several analysed devices would execute SIM-originating AT commands, the researchers used CATana to demonstrate the threats of the resulting SIM AT interface, leading to the discovery of multiple security vulnerabilities. Example attacks enabled by the presence of a SIM AT interface include:
- Re-enabling closed-down debug interfaces
- Exfiltrating sensitive information, such as a device’s unique identifier
- Sending messages or initiating calls
- Obtaining arbitrary command execution capabilities on a victim’s communication processor
- Forcing a device to downgrade from secure 4G connectivity to older and less secure 2G networks
- Shutting down the victim device; and
- Disabling cellular communications altogether.
Dr Marius Muench, Assistant Professor in Computer Science at the University of Birmingham, said: “The fascinating part here is that the proactive capabilities of a SIM and the resulting attack surface is explicitly defined in the technical specifications for cellular communication, resulting into ‘specification-compliant’ attacks.
“Other researchers, cybersecurity experts, and leaked intelligence documents have shown some of the dangers of hostile SIMs before us. Yet, the resulting risks have not been fully mitigated. Potentially, this is because hostile SIMs are not included in most threat models; although we slowly see a promising shift here.”
Building on their earlier work, the research team highlights four attacker scenarios leading to malicious or compromised SIMs and eSIMs, supported with precedents from real-world incidents:
- Remote attackers exploiting vulnerabilities in SIM software;
- Physical attackers replacing a victim’s SIM card or installing a hardware implant
- Compromised operators abusing remote SIM management features; and
- Supply-chain attackers modifying SIMs during manufacturing or distribution.
The researchers point out that the risks of SIM-originating AT commands are especially relevant for IoT devices such as industrial equipment, vehicle systems, or routers, as these are often locked down with only a limited number of exposed interfaces. The presence of a SIM AT interface could, therefore, serve as unforeseen entry vector for further compromising the victim device.
The study also comments on the more general risk of proactive SIMs, which can turn victim devices into surveillance tools. During the work building up to the publication, the researchers discovered that, on recent Android devices, a malicious SIM could force the phone to open an attacker-controlled website without any user interaction, even when the phone was locked.
Technology and threat
The researchers argue that many proactive SIM features are legacy technologies that were built only with benign SIMs in mind. However, as technology and threat surface is evolving, many features are no longer needed and create unnecessary security risks.
Kristian Covic, from Fuzzware, said: “At Fuzzware, we are very happy that we could support this research project. Hostile SIMs are an overlooked attack vector, and it's great that we could show this with our work."
The researchers did not stop at solely finding the vulnerabilities. They also reached out to the GSM Association (GSMA), as well as affected chip- and device manufacturers to address the found the issues.
Dr Muench reflects: “It was great working together with the affected companies and GSMA. Our reports were treated seriously, and key manufacturers made software updates and hardened configurations available to their customers. This will benefit billions of future SIM-enabled devices operating worldwide, including smartphones, connected vehicles, payment terminals, routers, critical infrastructure and EV charging systems.”
Asked about future research, Tomasz Piotr Lisowski said: “The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to the public light and hope to cooperate with vendors and standardization bodies to remedy the risks in today’s and future devices.”
The issues identified by the researchers as part of their study are tracked under CVE-2025-48618, CVE-2026-57550, and CVD-2026-0122.
