SIM cards can issue powerful commands to phones and cellular modules, creating security risks in cars, chargers, routers, and other devices.
A SIM card does more than connect a device to a cellular network. In the wrong hands, that built-in control can become a security risk.
Researchers found that a rigged SIM could order some devices to stop using 4G and connect over 2G instead – the oldest and weakest mobile network still running. It could hand over the serial number that identifies the device, send a text message, or shut it down.
Tomasz Piotr Lisowski and Marius Muench of the University of Birmingham built rigged SIMs with Kristian Covic of the security company Fuzzware . They tried them on 18 smartphones and eight cellular modules, including modules taken from an electric car charger , an industrial router, and a car.
Nine of the 26 devices ran the commands. None of this is an exploit in the usual sense: published standards for cellular networks give the card the right to send these commands.
Every cellular modem answers to a set of short typed instructions. Type one and the modem reports its firmware version, dials a number, or picks a network. These instructions are called AT commands.
The first ones shipped with the Hayes Smartmodem in 1981, and every manufacturer has added its own ever since.
Because the instructions can do so much, phone makers spent years restricting the interface. On a modern phone, you cannot reach it without special privileges.
The SIM has a separate door. A feature called Proactive SIM lets the card send a short list of requests back to the modem, including one that tells it to run an AT command.
The team picked 18 phones across 10 brands, with chips from six manufacturers. Only three of them accepted commands from the card.
Six of the eight modules took them. Those parts go inside equipment nobody thinks of as a computer: chargers, routers, meters, the telematics box in a car.
On the phones that refuse, the block was one entry on a list. In the modem software of a Google Pixel 9 and a Motorola One Vision, the team found the command on that list. The code that would run it is still there.
Muench, an assistant professor in computer science at Birmingham, said hostile SIM cards are not a threat most engineers plan for.
“Other researchers, cybersecurity experts, and leaked intelligence documents have shown some of the dangers of hostile SIMs before us. Yet, the resulting risks have not been fully mitigated. Potentially, this is because hostile SIMs are not included in most threat models; although we slowly see a promising shift here,” he said.
On an OPPO Reno 14 F 5G, the card cut the phone off from every network except 2G. The phone had been on 4G and could reach several 4G networks. Afterward, only 2G was available.
The owner cannot fix it from the phone. Airplane mode does not help, and neither does turning the SIM off in the cellular settings, toggling mobile data, or changing the preferred network generation. Switching to manual network selection just lists 2G networks.
The weakness comes from what 2G does not do. A 2G phone checks the tower’s identity far less strictly than a 4G phone, which is what makes fake cell towers workable.
Using two more commands, the researchers shut the handset down and then the modem. Both started working again after a reboot, and neither shutdown required a tap from the owner.
The most serious result came from an Autel electric vehicle charger with a Quectel module. A program on the module builds system commands out of text it receives, and a filter blocks the usual escape characters. It does not block a newline.
Lisowski’s team wrote a small wrapper program and used it to run their own code from the SIM.
On a standalone Quectel module they targeted files instead. Older firmware let file paths escape their own folder, and the file service does not check whether a file is real or a pointer to another one. The team created a link that pointed to another file, then used the module’s own email command to send that file to a server they controlled.
Every device that took the commands reported its type, firmware version, and unique hardware identifier when the card asked.
The team told Google, Oppo, Quectel, Semtech, and Qualcomm in March 2026, then brought in the GSMA – the mobile operators’ trade body – in May.
Qualcomm built a hardened setting that turns the interface off by default. Quectel has shipped a fix for the file problem and is working on the interface itself. Semtech plans to use Qualcomm’s patch.
Google and Oppo read the report and decided the issues fell outside their bug bounty programs .
“It was great working together with the affected companies and GSMA. Our reports were treated seriously, and key manufacturers make software updates and hardened configurations available to their customers,” Muench said.
The team found something else on recent Android phones. A card could force the browser open on a page of the attacker’s choosing, with the lock screen still on. Google has since patched the problem.
No one has counted how many of the chargers, routers, meters, and cars already installed carry a module that takes orders from its SIM. The survey covered only 26 devices, and modules like these ship in the millions.
“The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to the public light and hope to cooperate with vendors and standardization bodies to remedy the risks in today’s and future devices,” Lisowski said.
The full study was presented at the 2026 USENIX WOOT Conference on Offensive Technologies in Baltimore, and USENIX publishes the paper open access.
Check us out on EarthSnap , a free app brought to you by Eric Ralls and Earth.com.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
