Malicious SIM Cards Exploit Proactive Functionality to Hijack Devices Researchers from the University of Birmingham and Fuzzware have uncovered critical vulnerabilities in how SIM cards interact with smartphones and IoT devices, enabling attackers to execute code, steal data, or force devices onto insecure 2G networks. The findings, presented at the USENIX WOOT conference in Baltimore, highlight risks in proactive SIM functionality a feature designed to let SIMs issue commands to their host devices. Using a toolkit called CATANA, the team led by Tomasz Piotr Lisowski, Marius Muench, and Kristian Covic tested 26 devices (18 smartphones and 8 IoT modems). Nine devices exposed an AT command interface to the SIM, with IoT modems being particularly vulnerable (seven of eight tested). The attacks exploited RUN AT, a command that allows SIMs to execute legacy AT instructions, originally designed for modems in the 1980s. Key vulnerabilities demonstrated include: - Code execution on an Autel EV charger via a Quectel EC25-AFX modem. - Denial-of-service attacks, including forcing an Oppo Reno14 F 5G to power down or lock onto 2G (a downgrade resistant to standard fixes like airplane mode). - File theft from a Quectel EG25-G modem by combining malicious symbolic links with SIM commands. - Unauthorized browser launches on vulnerable Android versions (CVE-2025-48618), patched in December 2025 for Android 13–16. The attacks require SIM control, achievable through compromised software, physical tampering, or supply chain manipulation. While modern smartphones have reduced exposure, IoT devices remain at higher risk. The researchers disclosed findings to Google, Oppo, Quectel, Semtech, Qualcomm, and the GSMA. Qualcomm now disables the SIM AT interface by default, and the GSMA tracks the issue as CVD-2026-0122. The team advocates retiring RUN AT and other high-risk proactive SIM features to mitigate long-term threats.