PART 1
Threat landscape
A nearby operator can reach a phone over Wi-Fi or Bluetooth even when it is not joined to a network and cellular data is off. The bugs live in the radios, not in the SIM.
- ProtocolCriticalMar 2026
AirSnitch
A cross-layer identity flaw that bypasses the client isolation WPA2 and WPA3 rely on, then intercepts and rewrites traffic in both directions.
Architectural — no single patch
- ProtocolHigh2020
Zero-click AWDL
A 2020 demonstration that a nearby attacker could jailbreak an iPhone over Wi-Fi broadcast packets with no network join and no taps. Apple patched that bug. The class of attack is still real.
Patched — class of attack remains
- Active attackHighOngoing
Evil Twin
A rogue access point that copies a trusted SSID so phones and laptops join the attacker instead of the real network.
Requires operator gear nearby
- Active attackHighOngoing
Deauthentication
Forged management frames that knock a device off the real access point so it reconnects — often into an evil twin, or so a handshake can be captured.
PMF reduces, does not erase
- Active attackCriticalOngoing
Man-in-the-middle
Once on the path, the attacker can read or alter traffic between the client and the real network — credentials, sessions, downloads.
Follow-on after twin / AirSnitch
- Active attackHighOngoing
KARMA
The attacker answers a device’s probe requests for networks it already knows, so the phone joins a malicious AP that merely claimed the right name.
Feeds on preferred-network lists
- Active attackModerateOngoing
PMKID capture
Some access points hand over a PMKID that can be taken off-site and guessed against a wordlist. A long random passphrase makes this a dead end.
Offline guessing against a weak passphrase
- MalwareCriticalJul 2026
RedHook
Android malware that needs no root and no USB cable. It rides Accessibility permission into Wireless Debugging, then takes a shell.
Remove the app — no root required
- MalwareCriticalAug 2026
Manic trojan
When the infected phone cannot reach the internet, Manic walks stolen data across nearby infected devices over Wi-Fi Direct or Bluetooth — up to four hops.
Relays even with data and Wi-Fi off
- BluetoothCritical2025–2026
WhisperPair
A Fast Pair implementation flaw. Devices answer malicious pairing requests even when they are not in pairing mode, then hand over mic, audio, and Find Hub tracking.
Firmware update required
- BluetoothCriticalLate 2025
Airoha chipset
Three CVEs in Airoha-based audio gear let a nearby attacker connect without pairing, clone the link key, then reach the phone behind the headset.
Firmware — hundreds of millions of headsets
- BluetoothHighOngoing
BlueBait
A BLE honeypot that impersonates a device your phone already likes. When the phone takes the bait, it exposes identity and opens a path for the next stage.
Honeypot technique, not a single CVE