Mobile Network Threats

Rogue access points ("evil twin")

An attacker stands up an AP with the same SSID as a legitimate one (the coffee shop, the hotel, the conference). Phones with that SSID in their known networks auto-join. Once associated, the attacker is in the middle of every connection — with the ability to intercept DNS, inject pages, and downgrade unencrypted traffic.

Why it works: phones aggressively join known SSIDs. Open networks (no password) are indistinguishable to the device: any AP claiming "Starbucks WiFi" gets joined.

Captive portals

The "agree to the terms" web page on hotel/airport Wi-Fi. The portal sees every device's MAC address and the HTTP requests the phone makes before authenticating. A malicious portal can inject malicious code, capture credentials entered during the "agreement" flow, or hold the connection hostage to a paid upgrade.

IMSI catchers / Stingrays

Devices that pose as cell towers. Phones in range associate with them, exposing their IMSI (the SIM's unique identifier) and downgrading to weakly-encrypted 2G/3G modes that the attacker can decrypt in real time. Originally police surveillance tools; the hardware is now under $1,000 and the technique is documented widely.

What gets captured: IMSI (allows tracking by identity), phone calls, SMS, web traffic that didn't go through a VPN or HTTPS.

SS7 attacks

Signaling System 7 is the global telecom signaling protocol — built in the 1970s with no authentication. Attackers with SS7 access (purchased from compromised telecom employees or shady "global roaming" services) can intercept SMS (including 2FA codes), track phone location in real time, and redirect calls.

The 2017 O2 (Germany) bank account drain was an SS7 attack — criminals stole 2FA codes via SMS interception and drained accounts.

SIM swapping

The attacker convinces the victim's carrier — via phished employee credentials, social engineering, or paid insider — to port the victim's phone number to a SIM the attacker controls. The victim's phone goes silent; every SMS, including 2FA codes, goes to the attacker. Bank accounts, crypto wallets, and email accounts that use SMS recovery follow quickly.

The attack pattern is industrialized. "SIM swap as a service" exists on criminal forums. Carriers have improved verification but the human element (a bribed retail employee) remains exploitable.

eSIM hijacking

eSIM (the embedded SIM in modern phones) is easier to provision — which means easier to abuse. Attacker calls carrier, social-engineers them into provisioning a new eSIM "for a replacement device," activates it on attacker hardware, takes over the line. Similar outcome to physical SIM swap but easier to execute remotely.

Smishing & malicious links

SMS phishing — "your package is held; click here to pay $2 redelivery fee." Spoofed sender IDs, urgency, links to credential-harvesting pages or APK downloads. Less sophisticated than email phishing but with much higher click-through rates because users still trust SMS.

RCS attacks & iMessage exploits

Rich messaging protocols (RCS for cross-platform, iMessage between Apple devices) parse complex content: stickers, animations, link previews. The parsers are where zero-day exploits live. NSO's Pegasus famously delivered zero-click iMessage exploits that fully compromised phones via crafted attachments.

BlueBorne, KNOB, BIAS & friends

A steady drumbeat of Bluetooth stack vulnerabilities — pairing flaws, encryption negotiation bypasses, RCE in BT firmware. Most require proximity (10m or so), are patched quickly, but the patches don't reach every device — many cheap IoT devices and old phones never receive the updates.