Attackers can obtain logins, passwords, messages, and contacts from a smartphone even when the device is not connected to any network. Malware saves the collected information and transmits it via Bluetooth or Wi‑Fi to other infected phones that do have internet access. This was explained by Stanislav Pyzhov, head of the malware analysis group at the Solar 4RAYS cyber threat research centre.

How the Scheme Works

An infected smartphone without internet continues to collect data using its camera, microphone, and other sensors. The information is encrypted and stored in the device's memory until an opportunity to transmit it arises.

In August 2026, ThreatFabric specialists described the Android trojan Manic. It collects logins, passwords, SMS messages, push notifications, and contacts, encrypts them, and saves them on the phone. If direct contact with the command server is not possible, the program searches for other infected devices nearby and transmits the data via Wi‑Fi Direct or Bluetooth. The chain can include up to four intermediary smartphones.

Why This Is Technically Feasible

A similar principle is already used in legitimate services. Google's Find My Device and Apple's Find My allow phones to detect nearby devices and relay their location information. This makes it possible to track a lost or switched‑off smartphone: the data reaches the companies' servers through neighbouring gadgets. In other words, the mechanism of transmitting information without its own internet connection—and even with the screen off—already exists and is used quite legally.

How to Protect Yourself

The expert recommends installing apps only from official stores and carefully reviewing the permissions they request. Particular caution is needed when an app asks for access to special features, SMS, and notifications. Such privileges could allow attackers to control the device and intercept passwords along with confirmation codes.

In Brief

Malware can collect data on a smartphone without internet and transmit it via Bluetooth or Wi‑Fi to other infected devices that do have connectivity. An example of such a trojan is Manic, described in 2026: it saves logins, passwords, messages, and contacts, and can build a transmission chain through multiple phones. To protect yourself, it is important to install apps only from official sources and restrict dangerous permissions, especially access to SMS, notifications, and special features.