60
60
60
60
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.
ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.
67
60
60
60
60
60
60
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.
60
60
60
60
60
60
60
60
60
60
60
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.
ThreatFabric reported a new Android malware family called Manic combining banking fraud and surveillance capabilities, targeting 169 package IDs across Ukrainian banks, government and identity services, messaging apps, and Russian and European financial institutions. The malware uses phishing sites and dropper apps impersonating utilities for distribution and relies on accessibility services and notification permissions for keylogging, overlays, and remote control. It introduces a store-and-forward relay mechanism that stages encrypted data locally and relays it through nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting up to four hops when the primary device lacks internet access. Activity dates back to February 2026, with active development through late July.
72
60
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60