Qualcomm

Malicious SIM Card Commands Hijack EV Chargers and IoT Modules via Legacy AT Interface

Researchers from the University of Birmingham and Fuzzware demonstrated that a single malicious SIM card can issue proactive commands forcing cellular modules to execute arbitrary AT instructions. Testing of 26 devices revealed nine vulnerable units, including six out of eight cellular modules from Quectel used in EV chargers, industrial routers, and automotive T-Box systems. The attack leverages the long-standardized RUN AT proactive command introduced in 1981, which allows the SIM to instruct the modem and, in many cases, the application processor running Linux. Concrete exploits were shown on an Autel MAXI US AC W12-L-4G charger, an OPPO Reno 14 F 5G phone locked to 2G, and a Quectel EG25-G module enabling file exfiltration. Five vendors were notified in March 2026 yet none have issued public advisories as of August; the issues are tracked as CVE-2026-57550 and CVD-2026-0122. High Qualcomm-based modules remain widely deployed in critical infrastructure with no centralized visibility or uniform disablement mechanism.

630GB of Apple Secrets Leaked on Dark Web: WorldLeaks Breach Shatters Tata Electronics Supply Chain Security

In June 2026, the ransomware group WorldLeaks infiltrated Tata Electronics, Apple's key manufacturing partner in India, and exfiltrated 630GB of highly sensitive data comprising over 200,000 files that were subsequently posted on the dark web. The stolen materials include unreleased iPhone 18 Pro motherboard schematics, A20 Pro chip technical manuals, complete supplier lists, Tesla component designs, and employee passport copies, exposing the vulnerabilities in Apple's two-decade supply chain secrecy system built at a cost of billions of dollars. WorldLeaks, formerly known as Hunters International, employed a 'steal-only' tactic without encryption, capitalizing on the growing trend of data extortion that has proven more profitable than traditional ransomware. The breach raises serious concerns about Apple's ambitious India manufacturing expansion, which aims to increase local component sourcing from 10% to 50% within three years, and highlights broader risks to global supply chains involving companies such as Tesla, TSMC, and Qualcomm. Apple responded swiftly by deploying DMCA takedowns across platforms like X within 24 hours, yet the irreversible nature of dark web leaks underscores the need for enhanced supplier security audits, data segmentation, and proactive data loss prevention measures.