How can eSIM be hacked?

If you've been using eSIM technology for its convenience - no physical card required, quick switching between carriers, easy setup, and perfect for vacations. However, eSIMs aren't completely secure, and there are still a number of ways to hack them.

QR Code Fraud

When setting up an eSIM, you typically scan a QR code provided by your carrier. Attackers exploit this by creating a fraudulent QR code disguised as a legitimate setup tool. Scanning a fake QR code can redirect the device to a malicious eSIM profile, hijacking your cellular connection. Once compromised, the attacker can intercept your calls, messages, and data, potentially leading to identity theft or financial fraud.

To protect yourself, always verify QR codes by confirming them through official carrier channels and avoid scanning codes sent from untrusted sources or found in suspicious online advertisements or websites. If you are unsure, contact your carrier directly to confirm the authenticity of the QR code before scanning.

Phishing and Social Engineering

Phishing attacks are designed to trick you into revealing sensitive eSIM details. For example, a phishing or social engineering attack might impersonate your mobile operator through convincing emails or text messages, urging you to download a malicious eSIM profile or confirm your personal information. These attacks can be very convincing, mimicking the operator's logo, contact information, and official language, and sent from a spoofed email address or SMS address to appear legitimate.

While it may seem like you have nothing to worry about with a phishing attack like this (since you're a "normal person" without a super high net worth or anything), think again. Phishing attacks are often of the "spray-and-pray" variety, where the attacker sends out a large number of fraudulent messages and hopes that someone will fall victim.

Luckily, you can handle eSIM phishing attacks like any other scam attack: By not responding or interacting with any suspicious messages or phone calls.

Malware and spyware

Like a regular SIM card, an eSIM is vulnerable to malware. Malicious apps can access sensitive eSIM information, communications, and even track device activity. Similar to other eSIM attacks, the goal here is to eventually take control of eSIM communications with the aim of intercepting authentication codes, which could allow access to your secure accounts.

It's worth noting that malware that specifically targets your eSIM is rare. Back in 2019, the Simjacker exploit was discovered, but there really isn't anything similar currently available for eSIMs (at least that we know of). The device is more likely to be infected with malware designed to track and steal data, with the intent of accessing eSIM information. Additionally, while malware and spyware can attack and track your device, installing actual malware on your SIM or eSIM is also practically unheard of, and certainly not at the level of most attackers. This is the kind of spying in the dark, where you're more likely to click on a suspicious link than to become one of the first documented victims of actual eSIM malware.

To protect your device, only install apps from reputable app stores and always carefully review permissions before granting access. Regularly check your phone for unfamiliar or suspicious apps, delete unused or unneeded software immediately, and use reliable antivirus or security software to identify and remove potential threats.

iOS and Android Vulnerabilities

This is really related to malware and spyware, in that attackers will try to exploit known issues in the two major mobile operating systems to find an angle to attack your eSIM. Unfortunately, attackers are constantly exploring Android and iOS to find vulnerabilities that can be exploited to gain access to your device.

Most of the time, you can mitigate these issues by keeping your device up to date and avoiding installing apps from third-party sources. For Android devices, that means avoiding sideloading apps, as unofficial app stores can bundle malware that can infect your device. There have been numerous examples of malware accessing devices through sideloading, such as the ToxicPanda attack that drained bank accounts in 2024.

eSIM attacks are not as widespread as attacks on regular physical SIM cards. While eSIM technology really started to gain traction with the iPhone XR, XS, and XS Max, more smartphones than ever support the technology, meaning the attack surface is growing. In turn, this means more attackers are starting to focus on how to exploit eSIMs, so it's important to know what to look out for.

Marvin Fry

Update 04 June 2025