Last week, The Intercept published shocking new documents detailing a campaign by US and UK spies to hack into the SIM manufacturer Gemalto, stealing crucial encryption keys that protect and authenticate cellphone signals. But while it was clearly a major attack, I had a hard time seeing the operational benefits for the world’s spy agencies. SIM encryption only protects calls between your phone and the cell tower, which means any would-be surveillers would need to stay within a mile of the target. It’s also puzzling because carriers are often happy to hand over all their data with a blanket court order. Why would the GCHQ go to so much trouble for access to data they mostly already have?

But in the days since the report published, there's been concern over an even more frightening line of attack. The stolen SIM keys don't just give the NSA the power to listen in on calls, but potentially to plant spyware on any phone at any time. Once the stolen keys have bypassed the usual protections, the spyware would live on the SIM card itself, undetectable through conventional tools, able to pull data and install malicious software. If the NSA and GCHQ are pursuing that capability, it could be one of the biggest threats unearthed by Snowden so far.

The OTA key works as a kind of golden key to the SIM card, allowing almost total access to anyone who has it. Karsten Nohl, a researcher best known for his work on BadUSB, explored SIM hacks as part of a Black Hat presentation in 2013, and says the OTA keys would be a very likely target for an intelligence agency. The Intercept's documents also mention compromising Gemalto's ability to alter SMS records, which could be used to erase any suspicious OTA updates. The result would be a completely invisible program, running in an inaccessible portion of the phone. "It would be completely hidden from the user," says Nohl.

Earlier leaks show that the NSA has already developed malware that would work in just this way. The NSA's exploit catalog (first published by Der Spiegel) lists two different SIM-based malware apps: MONKEYCALENDAR sends back location data through hidden SMS messages, while GOPHERSET pulls a user's phone book, text and call logs. In both cases, the malware lives entirely on the SIM card, leaving no trace on the internal storage of the device. Neither slide says how the malware would be implanted, but once the OTA keys have been stolen, it would be as simple as sending a text.

But while the OTA keys are certainly valuable to the NSA and GCHQ, it's harder to say whether the agencies are actively harvesting them. The latest batch of documents shows that the agencies had full access to Gemalto's network, including the authentication servers that manage OTA keys, so at the very least, they could have stolen the keys if they wanted. But while the other documents show a concerted effort to harvest Ki keys, there's little mention of OTA keys beyond a single slide. The lack of evidence doesn't mean the agencies were ignoring the keys, of course; they may just have kept the harvesting efforts off Powerpoint.

Still, as the fallout from the Gemalto attack grows, it's hard to be reassured. So far, the company has denied any security breach and made little effort to address the leaks, although that may change at the company's scheduled press conference tomorrow morning. Still, without a major SIM recall, it's hard to say what the company could do to address the problem. Without secure SIM keys, the fundamental protections of mobile hardware are broken, exposing users to surveillance and potentially powerful new spyware tactics. And for the billions of customers using a Gemalto SIM, there's little help in sight.