The key facts

  • Researchers from the University of Graz found vulnerabilities in data transfer apps from seven brands
  • The attack was possible from a distance of 20–45 meters using equipment costing less than 100 euros
  • They managed to gain access to SMS messages, contacts, photos, passwords and Wi-Fi keys; in some cases — to inject malware

The essence of the study

Specialists from the Institute of Information Security at the University of Graz and the Center for Secure Information Technologies (Austria) tested data transfer apps from seven brands. Such apps help move information from an old smartphone to a new one via a direct Wi-Fi connection between the devices. The results were presented at the international computer security symposium ESORICS 2026.

What the researchers managed to do

In the experiments, the researchers exploited vulnerabilities in the data transfer process. Reportedly, it was enough to be within the range of the wireless network — at a distance of approximately 20–45 meters — and to use equipment costing less than 100 euros. During the tests, the specialists gained access to SMS messages, contacts, photographs, health data, passwords saved in apps, and Wi-Fi network keys. In individual cases, the possibility of substituting installation files of transferred apps and injecting malware onto the new smartphone was identified.

Who is affected by the risk

The risk does not apply to all scenarios of ordinary phone use, but to the process of transferring data through vulnerable apps. The publication notes that the issue is especially relevant for electronics stores and mobile phone shops, where customers are offered services for setting up a new phone and transferring data.

Reaction and recommendations

Before making the results public, the researchers notified the companies and gave them time to prepare protective updates. After that, the identified vulnerabilities were fixed. Specialists recommend updating the operating system and the data transfer app on both smartphones before transferring data — this reduces the risk of exploitation of the discovered vulnerabilities.