Malicious SIM Cards Exploit 'RUN AT' Command to Compromise Phones and IoT Devices
Researchers have demonstrated how malicious SIM cards can exploit the 'RUN AT' command to execute arbitrary AT commands, leading to data theft, denial of service, and device downgrades.
Researchers have uncovered a significant security vulnerability where malicious SIM cards can leverage the 'RUN AT' command to execute arbitrary AT commands on vulnerable smartphones and cellular-connected Internet of Things (IoT) devices. This functionality, intended for legitimate SIM operations, can be weaponized to perform actions such as leaking sensitive data, forcing devices to downgrade their network connection to slower 2G, initiating denial-of-service attacks, or even executing arbitrary code.
The research, presented at the USENIX WOOT conference, highlights how the proactive capabilities of a SIM card, specifically the ability to issue AT commands via the 'RUN AT' function, create a substantial attack surface. The team built a toolkit named CATANA to test this potential, examining 26 devices, including 18 smartphones and 8 IoT modems. They discovered that nine of these devices exposed an AT command interface to the SIM, with IoT modems being particularly susceptible.
Several critical vulnerabilities were identified and demonstrated. In one instance, attackers used a malicious SIM to exploit a command injection bug in a Quectel EC25-AFX cellular module found in an Autel EV charger, achieving code execution on the modem's underlying Linux system. On an Oppo Reno14 F 5G, researchers found 198 AT commands accessible through the SIM interface, some of which could power down the handset, disable its modem, or force a downgrade to 2G network speeds, a change that proved difficult to reverse.
The attack vector also extends to data exfiltration. Researchers demonstrated file theft against a Quectel EG25-G modem by combining a malicious symbolic link with SIM-originated commands to email a targeted file to an attacker-controlled server. This showcases the potential for sensitive information to be exfiltrated directly from the device's file system.
While these attacks require control over the SIM card itself—which could be achieved through compromised SIM software, physical tampering, or abuse by a malicious mobile network operator—the implications are far-reaching. Previous research and intelligence documents have indicated the risks associated with hostile SIMs, yet they remain underrepresented in many threat models.
Google has acknowledged a related Android flaw, tracked as CVE-2025-48618, which allowed a hostile SIM to invoke the 'LAUNCH BROWSER' command without user interaction, even on a locked device. This vulnerability was patched in December 2025 across Android versions 13 through 16. Following disclosure to various vendors and the GSMA, Qualcomm has since implemented a hardened configuration that disables the SIM AT interface by default, while the GSMA is tracking the broader issue as CVD-2026-0122.
The researchers advocate for the eventual retirement of risky proactive SIM functionalities like 'RUN AT' to mitigate these threats effectively. While modern smartphones appear to have largely addressed these concerns, the IoT sector, with its diverse range of devices and potentially longer support cycles, still requires significant attention to secure its connected infrastructure against such SIM-based attacks.