Every time a trusted Bluetooth device reconnected to an infected phone, the APK automatically forwarded a fresh payload to that device. No click. No warning. Just the silent, invisible handshake of two radios agreeing to trust each other.