Malicious SIM Cards Exploit 'RUN AT' Command to Compromise Phones and IoT Devices
Researchers have demonstrated how malicious SIM cards can exploit the 'RUN AT' command to execute arbitrary AT commands, leading to data theft, denial of service, and device downgrades.
Researchers have uncovered a significant security vulnerability where malicious SIM cards can leverage the 'RUN AT' command to execute arbitrary AT commands on vulnerable smartphones and cellular-connected Internet of Things (IoT) devices. This functionality, intended for legitimate SIM operations, can be weaponized to perform actions such as leaking sensitive data, forcing devices to downgrade their network connection to slower 2G, initiating denial-of-service attacks, or even executing arbitrary code.
The research, presented at the USENIX WOOT conference, highlights how the proactive capabilities of a SIM card, specifically the ability to issue AT commands via the 'RUN AT' function, create a substantial attack surface. The team built a toolkit named CATANA to test this potential, examining 26 devices, including 18 smartphones and 8 IoT modems. They discovered that nine of these devices exposed an AT command interface to the SIM, with IoT modems being particularly susceptible.
Several critical vulnerabilities were identified and demonstrated. In one instance, attackers used a malicious SIM to exploit a command injection bug in a Quectel EC25-AFX cellular module found in an Autel EV charger, achieving code execution on the modem's underlying Linux system. On an Oppo Reno14 F 5G, researchers found 198 AT commands accessible through the SIM interface, some of which could power down the handset, disable its modem, or force a downgrade to 2G network speeds, a change that proved difficult to reverse.
The attack vector also extends to data exfiltration. Researchers demonstrated file theft against a Quectel EG25-G modem by combining a malicious symbolic link with SIM-originated commands to email a targeted file to an attacker-controlled server. This showcases the potential for sensitive information to be exfiltrated directly from the device's file system.
While these attacks require control over the SIM card itself—which could be achieved through compromised SIM software, physical tampering, or abuse by a malicious mobile network operator—the implications are far-reaching. Previous research and intelligence documents have indicated the risks associated with hostile SIMs, yet they remain underrepresented in many threat models.
Google has acknowledged a related Android flaw, tracked as CVE-2025-48618, which allowed a hostile SIM to invoke the 'LAUNCH BROWSER' command without user interaction, even on a locked device. This vulnerability was patched in December 2025 across Android versions 13 through 16. Following disclosure to various vendors and the GSMA, Qualcomm has since implemented a hardened configuration that disables the SIM AT interface by default, while the GSMA is tracking the broader issue as CVD-2026-0122.
The researchers advocate for the eventual retirement of risky proactive SIM functionalities like 'RUN AT' to mitigate these threats effectively. While modern smartphones appear to have largely addressed these concerns, the IoT sector, with its diverse range of devices and potentially longer support cycles, still requires significant attention to secure its connected infrastructure against such SIM-based attacks.
This new reporting details specific instances of these malicious SIM card attacks, including code execution on an AUTEL EV charger's modem and the ability to force an OPPO Reno14 5G onto 2G networks persistently. It also highlights that Google has assigned CVE-2025-48618 to a related Android vulnerability allowing hostile SIMs to launch attacker-controlled websites without user interaction, which was patched in December 2025.
This new research expands on the previously reported 'RUN AT' command vulnerability by detailing its impact on specific IoT devices, including electric vehicle chargers and industrial routers. It highlights that nine out of 26 tested devices were susceptible, with five of those being Quectel modules. The findings also differentiate between affected phones and those unaffected, noting that future Qualcomm chipsets will have this interface hardened by default, while Quectel claims to have mitigated the file-access flaw and is working on the interface itself.