Some phones have baseband processors that can remain powered up even when the phone is officially off. No malware is required.