In short: On August 11, 2026, researchers from the University of Birmingham and Fuzzware presented proof at USENIX WOOT 2026 in Baltimore: a compromised SIM card can read files, execute modem commands, and force a 4G-to-2G downgrade — all bypassing Android's security model without leaving any trace in system logs. Nine out of 26 tested devices were vulnerable. GSMA and manufacturers have been notified and are issuing patches.
What Researchers Discovered: Proactive SIM and AT Commands
Tomasz Lisowski (University of Birmingham), Marius Münch and Christian Kovich (Fuzzware) identified a critical flaw in the decades-old Proactive SIM standard. This standard allows a SIM card to send commands directly to the device modem using the AT command protocol — a modem control language dating back to the 1980s.
While Proactive SIM has legitimate uses (sending SMS or triggering USSD codes), its RUN AT function — letting a SIM card pass arbitrary AT commands to the modem — proved to be a significant attack surface. The modem executes these commands unconditionally, without verifying the card's legitimacy. Android sees nothing: the entire chain operates below the operating system layer. The vulnerabilities carry identifiers CVE-2025-48618, CVE-2026-57550, and CVD-2026-0122.
This is a fundamentally different threat class from the familiar eSIM number hijacking attack: there, the attacker works through the carrier; here, the attack originates from the card inside the phone itself.
What a Compromised SIM Card Can Do
The researchers tested 26 devices: 18 consumer smartphones and 8 cellular IoT modules (EV chargers, connected vehicles, industrial routers). Of the 18 smartphones, 9 were vulnerable. Through a compromised SIM, an attacker can:
- Read arbitrary files — documents, photos, app data and caches;
- Execute commands on the communications processor, gaining direct control of the modem;
- Force a 4G-to-2G downgrade — the 2G standard uses far weaker cellular-layer encryption;
- Open websites on a locked phone without any user interaction;
- Carry out a denial-of-service attack, cutting the device off from the network;
- Extract device identifiers (IMEI, IMSI) for de-anonymisation;
- Enable hidden debug interfaces that are normally disabled.
None of these steps require touching the screen, and the attack leaves no visible traces in Android's system logs.
How a SIM Card Gets Compromised
The researchers identified four main threat vectors:
- Software exploitation of SIM firmware — via a vulnerability in the card's own microcontroller;
- Physical card swap — replacing the SIM with a prepared one during brief physical access to the device;
- Supply chain attack — modified SIM cards distributed through untrusted intermediaries;
- Carrier infrastructure breach — remote SIM re-flashing via compromised operator systems.
The researchers consider firmware exploitation and carrier infrastructure breach the most realistic vectors for mass exploitation. For more on mobile privacy protections, see the LiMP VPN features page.
Why Forcing 4G to 2G Is a Privacy Risk
2G networks use significantly weaker encryption algorithms at the carrier layer than 4G, and in some configurations cellular-layer encryption may be absent entirely. This opens the door to interception of voice calls, SMS messages, and mobile data via IMSI catchers (stingrays).
If you have a VPN installed, your internet data traffic is encrypted at the application layer — regardless of which cellular standard the network uses. Even in a forced 2G scenario, the VPN tunnel maintains that protection. However, a VPN does not encrypt voice calls or SMS, which remain vulnerable to interception over a 2G network.
How to Protect Yourself
Full remediation requires a device firmware update. Until a patch is available for your device:
- Check for system updates — several manufacturers are already co-ordinating patches with GSMA;
- Watch for an unexpected 4G to 2G switch without changing location — this can signal a downgrade attack;
- Get SIM cards only from your official carrier at authorised retail locations;
- Keep your phone in sight to prevent an opportunistic card swap;
- Use a VPN with kill switch — your internet traffic stays encrypted at the VPN layer even if cellular-layer encryption is weakened.