Bluetooth LE GATT

Manic hands stolen PINs to the phone next to it, up to four hops from any egress point

ThreatFabric says the Android malware encrypts what it steals and passes it over Wi-Fi Direct and Bluetooth until it reaches an infected device that is online. Network egress control never sees it.