SIM-based attack has been used to spy on people for two years

https://www.engadget.com/2019/09/14/simjacker-attack/?guccounter=1

The technique sends SMS messages containing instructions for an old S@T Browser app supported on some carriers' SIM cards. Where S@T was originally intended to launch browsers, play sounds or otherwise trigger common actions on phones, Simjacker uses it to obtain location info and IMEI numbers that are later sent to an "accomplice device" (again using SMS) that records the data.