Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access
Smartphones continue collecting data through built-in sensors even when internet connectivity is completely disabled. The common assumption that turning off Wi-Fi and mobile data makes a device invisible is incorrect. Sensors such as the microphone, camera, gyroscope, and GPS/GLONASS receiver operate independently of network connections and can record location, movement, and audio without sending any packets.
Satellite positioning works in receive-only mode, allowing a full daily route to be logged entirely offline. Collected information is queued in local storage and uploaded automatically at the first opportunity. Disabling the internet merely delays transmission rather than stopping surveillance.
Google’s Find My Device and Apple’s Find My (Locator) services can report location for several hours after the phone is switched off. A low-power Bluetooth chip remains active on backup power and broadcasts beacons that nearby devices relay to Google or Apple servers. The feature is limited to specific models, lasts only hours, and can be disabled in settings.
In August 2026, ThreatFabric researchers published details on the Manic trojan, which implements offline data exfiltration using short-range radio links. The malware encrypts files and commands, places them in a local queue, and searches for neighboring infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. When a neighbor with internet access is found, the package is forwarded; multi-hop routing of up to four intermediate devices is supported.
Real-world risk to ordinary users remains low because the mechanism requires a dense cluster of compromised devices. Targeted attacks against organizations with multiple infected handsets are more feasible. The more common threats are over-privileged legitimate apps and pre-installed malware on devices purchased from unofficial sellers.
Security recommendations include buying only from authorized vendors, installing applications exclusively from App Store, Google Play, or RuStore, strictly controlling permissions (especially “Special Access” and notification access), enabling Google Play Protect, and performing periodic privacy audits every 60–90 days. In case of suspected infection, change passwords from a clean device, enable airplane mode before data transfer, and perform a factory reset from recovery mode using a clean backup.
Related articles
LunaSpy Android Spyware Masquerades as FSB Antivirus and Bundles Right Dialer
Positive Technologies researchers discovered a malicious APK named Антивирус ФСБ.apk that installs the legitimate Right Dialer application from developer Goodwy while embedding the LunaSpy spyware. The sample uses package name com.syscore.toolsuite and requests extensive permissions including Accessibility Service to enable broad device control. Dynamic analysis in PT Sandbox revealed command-and-control communication, privilege escalation, and creation of hidden files. Static analysis showed XOR-encrypted strings and an expanded command set that includes call recording via CallService, call redirection rules in JSON format, screen tree extraction, gesture simulation, and anti-analysis commands such as RESET_REBOOT and DISABLE_PLAY_PROTECT. The malware can exfiltrate call recordings in WAV format, perform taps and swipes, and revive camera and microphone permissions through overlay notifications. Researchers published file and network indicators of compromise including multiple IP addresses used by the operators.
MegaFon Reports 34% Rise in Russian Mobile Malware Infections Driven by Android Trojans
MegaFon monitoring data shows a 34% year-over-year increase in Russian users with detected mobile malware during summer 2026, with the sharpest spike of 77% recorded in August. The growth is primarily attributed to Android trojans capable of installing apps without user consent, intercepting notifications, enabling remote access, and stealing personal data. At the same time, blocked suspicious calls dropped significantly, by 31% in June, 41% in July, and 75% in August, which the operator links to state and corporate anti-fraud measures. Scammers are adapting by hijacking messenger accounts through social engineering, malware, and even rental schemes, often combining calls with fake app installations that deploy spyware. Phishing remains active, with 30% of detected malicious resources tied to investments and crypto, 21% to social networks and messengers, and 9% to harmful APK files. Director Sergey Khrenov noted that smartphones are increasingly used as tools by the attackers themselves in these hybrid schemes.
Reflective DLL Injection: How Malware Executes DLLs Directly in Memory Without Disk Files
Reflective DLL Injection allows malicious code to load and execute a DLL entirely in memory, bypassing traditional file-based loading mechanisms on Windows. The technique uses a custom loader inside the DLL itself to handle PE format parsing, relocations, imports, TLS, and exception handling without calling LoadLibrary. Unlike standard loading, the resulting module often resides in MEM_PRIVATE regions and does not appear in conventional module lists, complicating forensic analysis. Tools such as Meterpreter and Cobalt Strike have historically employed reflective loaders, though Beacon Object Files represent a different COFF-based approach. Investigators must examine memory regions, thread start addresses, and Sysmon events 7, 8, and 10 rather than relying solely on file artifacts. The method does not bypass DEP, Arbitrary Code Guard, or access-control restrictions and leaves detectable traces when combined with behavioral indicators. Proper detection requires correlating private executable memory with process behavior and avoiding over-reliance on simplified signatures.
Leaked DarkSword iOS Exploit Chain 'P7' Now Steals Crypto Wallet Seeds and Keystores
A third build of the P7 variant of the leaked DarkSword iOS exploit chain has been identified, featuring a new lure site themed around Chinese online casinos and a fresh command server. The chain exploits six vulnerabilities, including three zero-days, to deploy an implant that decrypts the keychain directly on the device and extracts seed phrases from wallets such as imToken, Trust Wallet, and Phantom. Unlike the original GHOSTBLADE, P7 rewrites the C2 agent to focus exclusively on wallet data while retaining the core TaskRop and MIG-filter bypass modules. Passive analysis of public sources also uncovered the long-running 'qqtime' delivery cluster that pairs DarkSword with the older Coruna chain for broader iOS coverage. The operator uses channel codes to support multiple affiliate distributors and employs an AppleKeyStore oracle to decrypt keychain items locally before exfiltration.