Switching phones is your riskiest moment, and Clone2Pwn proves it

Which app on your phone handles the most sensitive data you own? Probably not your bank's. It's likely the one you open once every few years, half-distracted, while unboxing a new device: the "copy everything from my old phone" tool.

That tool just got a rough audit. Researchers from TU Graz and the A-SIT center in Austria analyzed the migration apps of seven vendors: Google, Samsung, Vivo, Xiaomi, Oppo, Huawei and Honor. According to TU Graz, they found vulnerabilities in every one of them that let an attacker within Wi-Fi range eavesdrop on or manipulate the transfer. Indoors, that range is roughly 20 to 45 meters, and the equipment cost less than 100 euros. The work, called Clone2Pwn, was presented at ESORICS 2026.

The exposed material included text messages, contacts, photos, health data, saved Wi-Fi credentials and app passwords. In some cases, tampered app packages could inject malware into the new phone. All seven vendors have since released security updates, and the manufacturers confirmed the severity of the issues, including five classified as high.

The convenience is the vulnerability

These tools exist to move nearly everything on your phone in one go, without an external server in between, over a direct Wi-Fi link between two devices. That's a great user experience. It's also, by design, a concentrated stream of the most valuable data you have, flowing over radio waves for anyone close enough to listen. When the researchers say almost the entire contents of a phone are transferred, that isn't a footnote. It is the threat model.

In our view, the industry treated these apps as a friendly onboarding feature, not as security-critical software. Nobody ships a payments module with that attitude. Yet the migration app handles the keys to all of them, and per the researchers it comes preinstalled on almost every Android device.

"All seven" is the number that matters

Twelve billion downloads, a total Tech Xplore reports for the apps examined, makes a headline, but the more telling figure is seven out of seven. This wasn't one sloppy vendor. It looks like a category-wide blind spot: everyone built the same kind of tool, and everyone made it breakable. That points to a shared design habit, not a one-off bug. We think that's the uncomfortable part, and it's why we'd be wary of treating "patched" as "solved."

To be fair, the vendors deserve some credit. The team followed responsible disclosure, the manufacturers confirmed the problems, and every one has shipped fixes. That is how it should work. But in our opinion, a patch is not the same as a security review before launch, and that's the habit we'd like to see change.

Where the risk is real, and where it isn't

Let's not overreact. The attack requires proximity, and nothing in the documentation suggests mass exploitation. For most people moving phones at home, the practical risk is probably modest. The researchers themselves single out places where many transfers happen every day, such as electronics stores and carrier shops. If a store employee offers to move your data for you, that's precisely the kind of setting they flag as particularly vulnerable.

There's also a hidden cost: in some cases the fix may require updating the entire operating system, not just the app. We suspect that makes life hardest for people with old, neglected phones, which is exactly who is likely to be switching to a new one.

What to do before your next upgrade

The advice from the researchers is simple, and we'd follow it to the letter: make sure the latest version of the migration app is installed on both devices, and install all relevant updates, including the system itself if needed. Do it before you start, not after. If you can, do the transfer at home rather than in a crowded store.

Our verdict: Clone2Pwn is not a reason to avoid these apps, since they remain the easiest way to move house digitally. It is a reason for vendors to give them the same threat modeling, audits and update discipline as a wallet or password manager. The moment you change phones should be the most carefully protected moment of your digital life. Today, it's one of the least.