Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.
ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.
- Manic targets Ukrainian banks, government and identity services, plus Russian and European financial institutions
- Accessibility service used as UI keylogger classifying lock-screen input, PINs, passwords and messages
- Offline mesh relay moves encrypted data through up to four infected-device hops without internet
- WebRTC enables live screen monitoring and remote interaction with the device
- July build adds anti-analysis, in-memory DEX loading and lock-secret PIN phishing
- ATT&CK
- T1517 Accessibility ModsT1417.002 KeyloggingT1041 Exfiltration Over C2 ChannelT1436.002 Screen Capture Input CaptureT1571 Non-Standard Port
- Vendors
- ThreatFabric
- Products
- Manic
- Malware
- Manic
- Organizations
- ThreatFabricSecurity Affairs
From the original article
4 min read at securityaffairs.com
Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline. ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development as of July.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.