Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access
Smartphones continue collecting data through built-in sensors even when internet connectivity is completely disabled. The common assumption that turning off Wi-Fi and mobile data makes a device invisible is incorrect. Sensors such as the microphone, camera, gyroscope, and GPS/GLONASS receiver operate independently of network connections and can record location, movement, and audio without sending any packets.
Satellite positioning works in receive-only mode, allowing a full daily route to be logged entirely offline. Collected information is queued in local storage and uploaded automatically at the first opportunity. Disabling the internet merely delays transmission rather than stopping surveillance.
Google’s Find My Device and Apple’s Find My (Locator) services can report location for several hours after the phone is switched off. A low-power Bluetooth chip remains active on backup power and broadcasts beacons that nearby devices relay to Google or Apple servers. The feature is limited to specific models, lasts only hours, and can be disabled in settings.
In August 2026, ThreatFabric researchers published details on the Manic trojan, which implements offline data exfiltration using short-range radio links. The malware encrypts files and commands, places them in a local queue, and searches for neighboring infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. When a neighbor with internet access is found, the package is forwarded; multi-hop routing of up to four intermediate devices is supported.
Real-world risk to ordinary users remains low because the mechanism requires a dense cluster of compromised devices. Targeted attacks against organizations with multiple infected handsets are more feasible. The more common threats are over-privileged legitimate apps and pre-installed malware on devices purchased from unofficial sellers.
Security recommendations include buying only from authorized vendors, installing applications exclusively from App Store, Google Play, or RuStore, strictly controlling permissions (especially “Special Access” and notification access), enabling Google Play Protect, and performing periodic privacy audits every 60–90 days. In case of suspected infection, change passwords from a clean device, enable airplane mode before data transfer, and perform a factory reset from recovery mode using a clean backup.
Related articles
Reconstructed Stuxnet Source Code Published on GitHub with Build Instructions
An unknown researcher has released a reconstructed version of the Stuxnet worm source code on GitHub, including reverse-engineering results and assembly instructions. Stuxnet was discovered in 2010 and is widely attributed to the joint US-Israeli Olympic Games operation targeting Iran's Natanz uranium enrichment facility. The malware specifically attacked Siemens industrial controllers by altering frequency converter operations to physically damage centrifuge rotors while falsifying operator displays. Propagation relied on USB drives, network shares, and a Windows Print Spooler vulnerability, combined with stolen Realtek and JMicron driver-signing certificates. The worm also injected itself into Siemens WinCC and Step 7 software to intercept communications with programmable logic controllers. Due to a flaw in its environment checks, Stuxnet escaped the target network and spread publicly before its built-in June 2012 self-destruct date. Researchers are advised to analyze the code only inside fully isolated virtual machines without network access.
Researchers Create 0-Click WeChat Worm That Hijacks Accounts via Incoming Calls
Security researchers at Calif have developed a 0-click worm capable of compromising WeChat accounts through incoming voice calls without any user interaction. The exploit requires only that the attacker already exists in the victim's contact list and works across Android and iOS devices. In demonstrations, an infected Android device called an iPhone to seize control of its WeChat account while the call continued ringing, after which the compromised iPhone targeted another Android device. The worm spreads automatically between trusted contacts, functioning like a classic network worm but using WeChat profiles as propagation nodes. Even if the victim answers or declines the call, the exploit can persist or be retried, for example during nighttime hours. After account takeover, attackers gain full control to read and send messages, make calls, and impersonate the owner, while the underlying smartphone itself remains unaffected. Tencent received notification in July, released patches in versions 8.0.77 for Android and 8.0.76 for iOS, and server-side blocking was confirmed by late August, with no real-world attacks observed so far.
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.