Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
A sophisticated new Android malware, Manic, targets financial, government, and communication services in Ukraine, Russia, and Europe, using a novel Wi-Fi mesh technique to exfiltrate data from offline devices.
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. This sophisticated spyware combines banking fraud capabilities with data-stealing functionalities, posing a significant threat to sensitive information.
Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features. The malware, besides targeting sensitive applications and enabling extensive device takeover, introduces a novel Wi-Fi mesh technique that makes it possible for the infected devices to relay data through nearby compromised devices with internet access. It's distributed via phishing sites and dropper apps impersonating utilities.
The malware family's activity dates back to February 2026, with active development efforts ensuing shortly after. The newer iteration of the wrapper and implant have been found to incorporate stronger anti-analysis checks and the ability to phishing lock screen secrets. A corresponding panel and API subsequently went live between July 24 and 28, indicating a mature and evolving threat.
An examination of the malware reveals that it monitors 169 package IDs associated with banks, peer-to-peer (P2P) payment and Buy Now, Pay Later (BNPL) services, cryptocurrency wallets and exchanges, messaging apps, government and e-ID services, browsers, authenticators, and email clients. The majority of the targets are Ukrainian, but also present in the list are apps used in Russia, Central and Western Europe, and the U.K.
Manic is designed to target commercial and military-focused messaging apps. Because the malware facilitates location tracking, notification monitoring, file collection, and remote device surveillance, the broad targeting allows the operator to keep tabs on a victim's financial activity, communications, and their whereabouts in real-time. Like other Android malware families, Manic achieves its goals by abusing Android's accessibility services and notification permissions, effectively allowing it to capture lock screen secrets or serve fake overlays to gather sensitive data.
Some of Manic's noteworthy features include the ability to intercept keypad interactions to collect passwords and one-time codes, leverage accessibility services as a "UI keylogger," monitor the screen and interact remotely over a WebRTC session, remove the implant from the launcher, record location data, take screenshots, export contacts and messages, and disable Google Play Protect through UI automation. It can also capture PIN codes by serving a transparent overlay atop the legitimate numeric keypad in targeted apps.
Perhaps the most unusual aspect of Manic is its store-and-forward relay mechanism to exfiltrate data using another device that's in close physical proximity to the compromised Android phone if it cannot connect to the attacker-controlled infrastructure. With this approach, the idea is to allow the source device to remain offline while the malware attempts to locate a second infected device that can provide an alternative pathway to the command-and-control (C2) server. The relay mechanism works by staging collected files in an encrypted format, locating a nearby infected peer using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, and then relaying the encrypted package toward the C2 server.
Manic also supports multi-hop routes, enabling the queued items to be configured for a maximum of four relay hops by default. If no peers are found, the data is kept in the queue, and the whole process is retried later. Persistence relies on background workers, alarms, and the Accessibility and notification services, which maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh.
This new article provides further technical details on the Manic malware's operation, specifically highlighting its novel method of stealing PINs by overlaying a transparent keypad on legitimate banking apps and then replaying taps via Android's Accessibility service. It also elaborates on the malware's ability to capture device unlock codes and its use of WebRTC for live screen-sharing sessions, offering attackers interactive remote control.