Your phone is a bridge for attackers

# Your phone is a bridge for attackers The most interesting thing on the wire this week isn't a massive breach of a Fortune 500 company, though we have plenty of those. It’s a piece of Android malware called Manic. Most criminals want to get into your network via a phishing email or a leaky VPN. Manic does something different: it uses a Wi-Fi mesh technique to exfiltrate data from phones that aren't even connected to the internet. If an infected device gets close enough to another infected device, they can pass data back and forth until one of them finds a way out. It effectively turns your employees' pockets into a relay race for stolen data. For a ten-person shop, this is a nightmare because you can't "firewall" a physical room where people are sitting with their phones. The standard advice here would be to "simply deploy" an Enterprise Mobility Management (EMM) suite. That’s nonsense. A small firm doesn't have the budget or the headcount to manage a fleet of locked-down handsets. The practical move is a boring policy: no work data on personal devices, and for the few company-issued phones you have, disable "Nearby Share" and similar discovery protocols by default. It’s an unglamorous control, but it breaks the mesh. Then we have the identity crisis. Microsoft patched a remote code execution flaw in Entra ID with a CVSS score of 10.0. That's the highest possible severity rating. The problem is that this wasn't just a theoretical bug; it was exploited in the wild. Around the same time, GitLab saw its CVE-2026-19478 code injection flaw get hit by attackers almost immediately after disclosure. Here is where the divide between an enterprise and a small shop becomes a canyon. An enterprise has a Security Operations Center (SOC) that spends the afternoon parsing logs to see if any unusual service principals were created during the vulnerability window. A ten-person shop just sees a "Microsoft updated your services" notification and assumes everything is fine. I'll take a position here: the "managed" nature of cloud identity is a trap. We’ve been told that moving to the cloud removes the burden of patching, which is true for the software, but not for the state of your account. A patch closes the door, but it doesn't kick out the person who walked through while the door was open. If an attacker used that Entra ID flaw to create a backdoor account or escalate privileges, they are still there, regardless of whether Microsoft patched the hole yesterday. The only way a small shop handles this without a security team is by auditing their own users. Go into your identity portal and look for any guest accounts or administrative roles you don't recognize. It’s free, it’s boring, and it’s the only thing that actually works when the provider is the one who left the door open. Speaking of doors, the ransomware gangs are currently operating at an industrial scale. Clop has breached over 50 organizations recently—names like GE, Philips, and Shell—often by targeting a single point of failure in PLM software. Meanwhile, Medusa has hit over 500 victims. This isn't "hacking" in the way movies show it; this is automated scanning for one specific version of one specific piece of software, followed by a script that does the rest. The second-order effect here isn't just the data loss at GE or Shell. It’s the insurance market. When 500 companies are hit by the same campaign, it creates a systemic risk that insurers can't diversify away. We’re going to see premiums spike for any company using "unsupported" or "legacy" software because the insurers now know exactly how efficient these automated sweeps are. There is a common objection that small firms are "too small to be targets." That logic died years ago. Attackers don't target companies; they target vulnerabilities. If you use the same version of a server as Shell, you are just as visible on a scanner. The only difference is that Shell has a team to respond, and you have a panicked Friday afternoon. The tech sector remains the primary target, with 183 stories this week alone. That’s not because attackers love code; it's because tech companies often have the most permissive internal permissions and the fastest-growing attack surfaces. If you provide services to the tech sector, you are effectively inheriting their risk profile. When I look at these trends, I see a recurring pattern: we keep adding complexity (AI pipelines, mesh networking, cloud identity) without updating our basic hygiene. We’re building skyscrapers on sand and wondering why the windows are cracking. The "advanced" threats like Manic malware only work because we've stopped caring about the basics of device isolation. If you're running a small operation, your goal isn't to be unhackable—that's an expensive fantasy. Your goal is to be too boring to bother with. You want the attacker to hit your perimeter, find MFA enabled, see that your backups are offline and encrypted, realize your software is actually patched, and move on to someone who "simply deployed" a complex solution they don't know how to manage. Check your Entra ID or Google Workspace admin logs this week for any new global administrators or unexpected guest accounts created in the last 30 days.