Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access

Smartphones continue collecting data through built-in sensors even when internet connectivity is completely disabled. The common assumption that turning off Wi-Fi and mobile data makes a device invisible is incorrect. Sensors such as the microphone, camera, gyroscope, and GPS/GLONASS receiver operate independently of network connections and can record location, movement, and audio without sending any packets.

Satellite positioning works in receive-only mode, allowing a full daily route to be logged entirely offline. Collected information is queued in local storage and uploaded automatically at the first opportunity. Disabling the internet merely delays transmission rather than stopping surveillance.

Google’s Find My Device and Apple’s Find My (Locator) services can report location for several hours after the phone is switched off. A low-power Bluetooth chip remains active on backup power and broadcasts beacons that nearby devices relay to Google or Apple servers. The feature is limited to specific models, lasts only hours, and can be disabled in settings.

In August 2026, ThreatFabric researchers published details on the Manic trojan, which implements offline data exfiltration using short-range radio links. The malware encrypts files and commands, places them in a local queue, and searches for neighboring infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. When a neighbor with internet access is found, the package is forwarded; multi-hop routing of up to four intermediate devices is supported.

Real-world risk to ordinary users remains low because the mechanism requires a dense cluster of compromised devices. Targeted attacks against organizations with multiple infected handsets are more feasible. The more common threats are over-privileged legitimate apps and pre-installed malware on devices purchased from unofficial sellers.

Security recommendations include buying only from authorized vendors, installing applications exclusively from App Store, Google Play, or RuStore, strictly controlling permissions (especially “Special Access” and notification access), enabling Google Play Protect, and performing periodic privacy audits every 60–90 days. In case of suspected infection, change passwords from a clean device, enable airplane mode before data transfer, and perform a factory reset from recovery mode using a clean backup.