Researchers Unveil ‘5G‑Shark’ Tool That Can Coax Smartphones onto Fake 5G Towers

A consortium of security researchers has demonstrated a new proof‑of‑concept attack dubbed “5G‑Shark,” which can coax modern smartphones to connect to unauthorized 5G base stations without disrupting the legitimate network. By exploiting the way devices select the strongest signal, the tool can silently redirect traffic, harvest subscriber identifiers and even force a downgrade to older, less secure cellular protocols.

The technique works by broadcasting a rogue 5G cell that appears more attractive than nearby legitimate towers. When a phone detects the stronger signal, it automatically attaches to the counterfeit base station, a behavior built into the cellular standards to ensure seamless connectivity. Once attached, 5G‑Shark can extract the device’s International Mobile Subscriber Identity (IMSI) and other metadata, information that can be used for tracking or further attacks.

Beyond data collection, the researchers showed that the rogue station can compel the phone to fall back to 4G or even 2G networks, where encryption is weaker and known vulnerabilities are more abundant. This downgrade capability effectively opens a pathway for classic IMSI‑catcher attacks that have plagued earlier generations of mobile security.

The demonstration underscores a growing concern among telecom experts: as networks transition to 5G, the underlying radio access procedures have not been fully hardened against manipulation. While 5G promises stronger encryption and integrity checks, the initial attachment process still relies on unencrypted signaling, giving tools like 5G‑Shark a window of opportunity.

Industry stakeholders have responded by emphasizing ongoing efforts to patch protocol weaknesses and to deploy authentication mechanisms such as 5G‑AA (Authentication Assurance). However, the researchers caution that widespread deployment of such safeguards may take years, leaving a gap that sophisticated adversaries could exploit in the interim.

The findings, originally reported by Hackread, serve as a reminder that the evolution of mobile infrastructure must be matched by equally rapid advances in security. As regulators and network operators assess the implications, the hope is that the exposure will accelerate the rollout of robust countermeasures, reducing the risk that everyday users become unwitting participants in rogue cellular networks.