Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.
.claude/skills/cyberstrikeus-t1451-sim-card-swap/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 10% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -75% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -26% | 0% |
| case-11 | ✗→✓ | ▲ Improved | -42% | 0% |
| case-12 | ✗→✓ | ▲ Improved | -35% | 0% |
Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.
The typical process is as follows:
Adversaries may use the intercepted SMS messages to log into online accounts that use SMS-based authentication. Specifically, adversaries may use SMS-based authentication to log into banking and/or cryptocurrency accounts, then transfer funds to adversary-controlled wallets.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to SIM Card Swap by examining the target platforms (Android, iOS).
Review whether mitigations for T1451 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Enterprises should monitor for SIM card changes on the Enterprise Mobility Management (EMM) or the Mobile Device Management (MDM).
The user should become familiar with social engineering tactics that ask for Personally Identifiable Information (PII). Additionally, the user should include the use of hardware tokens, biometrics, and other non-SMS based authentication mechanisms where possible. Finally, the user should enable SIM swapping protections offered by the mobile carrier, such as setting up a PIN or password to authorize any changes to the account.
| Finding | Severity | Impact | | ---------------------------------- | -------- | -------------- | | SIM Card Swap technique applicable | High | Initial Access |
| CWE ID | Title | | ------ | ------------------------- | | CWE-20 | Improper Input Validation |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-14 | pass→pass | 18,729 | 17,740 | -5% | 1 | 1 | 0% | 2,114 | 2,730 | +29% | 0 | 0 | — |
case-15 | pass→pass | 13,572 | 16,006 | +18% | 1 | 1 | 0% | 2,107 | 2,451 | +16% | 0 | 0 | — |
case-16 | pass→pass | 19,701 | 19,679 | -0% | 1 | 1 | 0% | 2,183 | 2,730 | +25% | 0 | 0 | — |
case-17 | pass→pass | 21,119 | 20,865 | -1% | 1 | 1 | 0% | 2,235 | 3,125 | +40% | 0 | 0 | — |
case-01 | fail→pass | 30,024 | 27,656 | -8% | 1 | 1 | 0% | 3,952 | 4,332 | +10% | 0 | 0 | — |
case-02 | fail→fail | 24,445 | 30,537 | +25% | 1 | 1 | 0% | 2,949 | 3,983 | +35% | 0 | 0 | — |
case-03 | pass→pass | 21,662 | 23,014 | +6% | 1 | 1 | 0% | 3,042 | 4,397 | +45% | 0 | 0 | — |
case-04 | pass→pass | 26,051 | 19,928 | -24% | 1 | 1 | 0% | 3,359 | 4,073 | +21% | 0 | 0 | — |
case-05 | pass→fail | 20,610 | 24,566 | +19% | 1 | 1 | 0% | 3,151 | 3,633 | +15% | 0 | 0 | — |
case-18 | pass→pass | 24,652 | 16,832 | -32% | 1 | 1 | 0% | 2,616 | 2,963 | +13% | 0 | 0 | — |
case-06 | fail→pass | 23,970 | 7,226 | -70% | 1 | 1 | 0% | 4,355 | 1,085 | -75% | 0 | 0 | — |
case-07 | fail→pass | 12,919 | 7,892 | -39% | 1 | 1 | 0% | 1,504 | 1,111 | -26% | 0 | 0 | — |
case-08 | pass→pass | 27,229 | 8,835 | -68% | 1 | 1 | 0% | 3,823 | 1,326 | -65% | 0 | 0 | — |
case-09 | pass→pass | 21,505 | 20,389 | -5% | 1 | 1 | 0% | 2,868 | 3,121 | +9% | 0 | 0 | — |
case-10 | pass→pass | 16,227 | 8,660 | -47% | 1 | 1 | 0% | 1,748 | 1,002 | -43% | 0 | 0 | — |
case-11 | fail→pass | 19,041 | 9,694 | -49% | 1 | 1 | 0% | 2,148 | 1,248 | -42% | 0 | 0 | — |
case-12 | fail→pass | 41,821 | 2,941 | -93% | 1 | 1 | 0% | 1,910 | 1,241 | -35% | 0 | 0 | — |
case-13 | pass→pass | 11,912 | 8,521 | -28% | 1 | 1 | 0% | 1,134 | 1,170 | +3% | 0 | 0 | — |
case-19 | fail→pass | 14,290 | 6,570 | -54% | 1 | 1 | 0% | 1,637 | 918 | -44% | 0 | 0 | — |
case-20 | pass→pass | 21,477 | 9,232 | -57% | 1 | 1 | 0% | 2,533 | 1,017 | -60% | 0 | 0 | — |
case-21 | pass→pass | 15,960 | 18,799 | +18% | 1 | 1 | 0% | 1,662 | 2,466 | +48% | 0 | 0 | — |
case-22 | pass→pass | 20,031 | 8,217 | -59% | 1 | 1 | 0% | 2,026 | 1,174 | -42% | 0 | 0 | — |
case-23 | pass→pass | 14,653 | 12,692 | -13% | 1 | 1 | 0% | 1,183 | 1,810 | +53% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +22 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.