Malicious SIM Cards Can Hijack Smartphones and IoT Devices, Research Shows
University of Birmingham researchers demonstrate how 'Proactive SIM' technology allows compromised chips to control modems without software exploits.
Researchers from the University of Birmingham have revealed that compromised SIM cards can be used to hijack smartphones and connected devices. Presented at the 2026 USENIX WOOT conference in Baltimore, the findings show that attackers can execute instructions directly on a device's modem, bypassing traditional software security layers.
The attack leverages "Proactive SIM" technology, specifically the "RUN AT" command, to send AT commands—standard instructions used to control modems—directly to the hardware. In a study involving 26 devices, including 18 smartphones and 8 cellular-connected IoT modules such as industrial equipment and EV chargers, the team demonstrated that a malicious SIM could secretly send messages and make calls, exfiltrate device IDs, and force a persistent downgrade to insecure 2G networks. In some cases, the SIM could even shut down the device entirely.
The Hardware Attack Surface
Since their introduction in 1991, SIM cards have been largely viewed as passive storage for subscriber identities. However, the "Proactive SIM" feature allows the card to initiate actions independently. The researchers identified four primary vectors through which a SIM could be compromised: software bugs within the SIM itself, physical replacement or implants, the compromise of a mobile operator's remote management systems, or supply-chain tampering during the manufacturing process.
Industry Implications
This research highlights a critical hardware-level vulnerability that operates beneath the operating system. Because the attack targets the modem, it affects a wide array of infrastructure beyond consumer phones. For example, researchers successfully exploited a command injection bug in the Linux-based application processor of a Quectel module used in an Autel EV charger to achieve full code execution. On an Oppo Reno14 F 5G, they demonstrated the ability to kill the modem and power down the handset.
The implications for the IoT sector are particularly severe. The ability to control connected cars, EV chargers, and industrial equipment via the SIM card poses a significant risk for large-scale espionage or infrastructure disruption. This is especially concerning if backdoors are inserted during manufacturing by state actors, as such implants would be nearly impossible for the end-user to detect.
What's Next
The study underscores the need for modem manufacturers and mobile operators to rethink the trust relationship between the SIM card and the device modem. While the researchers have mapped the capabilities of these attacks, the industry must now determine how to restrict the "RUN AT" command or implement stricter validation for proactive SIM requests to prevent unauthorized hardware control.