A new Android threat, codenamed Manic Android malware, has been observed targeting organizations and services across financial, identity, and communications sectors. Security researchers report that it goes beyond typical banking-fraud behavior by combining surveillance, device control, and a specialized method for moving stolen information—potentially even when a victim phone cannot reach the attacker’s infrastructure.
According to a technical report shared with The Hacker News by ThreatFabric, Manic overlaps the capabilities of Android banking malware and mobile spyware. That blend helps attackers pursue both financial misconduct and broader monitoring of a victim’s activity, communications, and location.
Targets include banks, identity services, and messaging apps
Manic is reported to monitor a large set of application package identifiers. In total, researchers identified 169 package IDs tied to targets such as banks, peer-to-peer payment platforms, Buy Now Pay Later services, cryptocurrency wallets and exchanges, messaging applications, government and eID-related apps, browsers, authenticator tools, and email clients.
While the highest concentration of targeted apps appears to be in Ukraine, the list also includes apps used in Russia, parts of Central and Western Europe, and the U.K. ThreatFabric notes that the target set points to a combined objective: financial fraud alongside broader spyware-style coverage.
In parallel, Manic is described as designed to target commercial and military-focused messaging apps. Because it can support location tracking, notification monitoring, file collection, and remote device surveillance, the operators can keep tabs on a victim’s financial activity, communications, and whereabouts in near real-time.
How Manic abuses Android accessibility and notifications
Like many Android malware families, Manic relies on features that help apps observe and interact with the user interface. Researchers describe the malware as abusing Android accessibility services and notification permissions. These capabilities enable behaviors such as collecting lock-screen secrets, showing overlays to capture sensitive input, and hiding malicious activity behind black screens or fake update screens.
The reported functionality is extensive and includes:
- Intercepting keypad interactions to capture passwords, one-time codes, and recovery phrases
- Using accessibility as a form of UI keylogging to identify text and associate it with the app being used
- Monitoring the screen and enabling remote interaction through a WebRTC session
- Collecting device information such as current coordinates and timestamps, and taking screenshots
- Exporting contacts, call history, SMS messages, and notifications
- Retrieving the list of installed apps
- Sending SMS messages to an attacker-supplied number along with attacker-provided text
- Displaying fraudulent notifications, deleting local files, and locking the screen via accessibility
- Attempting to disable Google Play Protect using UI automation
Phishing lock-screen and PIN theft without a fake banking screen
One particularly notable capability is Manic’s approach to stealing PIN codes. Instead of relying solely on fake banking interfaces, the malware can serve a transparent overlay on top of the legitimate numeric keypad inside a targeted app.
When the user taps on the overlay, Manic records the exact tap position and the nearby UI element. It then temporarily changes how it handles touch interception and uses accessibility services to replicate the tap at the same location on the real keypad. As a result, the targeted app appears to function normally from the user’s perspective, while the attacker gains the PIN.
This design helps reduce user suspicion because the PIN capture can occur without requiring the malware to visibly present a full fake banking interface.
Activity timeline shows continued development
ThreatFabric reports that the Manic campaign timeline begins in February 2026, when the first domain was registered under a fabricated persona. Soon after, development work accelerated, with an early lure and wrapper using a booking-app theme. The implant reportedly appeared by the end of May.
Researchers also observed interruptions: development efforts were reportedly abandoned from late June to mid-July, before signs of a second deployment emerged around July 13. The later wrapper and implant versions include stronger anti-analysis checks and improved phishing approaches, including lock-screen secret collection.
A panel and API were also said to have gone live between July 24 and July 28, suggesting the campaign continued to mature beyond initial delivery.
APK names identified in the campaign
Researchers provide examples of application package names tied to the wrapper and implant components. The reported APK-related names include:
- tech.intel.dialer.updater (Wrapper)
- org.honor.secure.helper (Wrapper)
- org.lenovo.storage.processor (Implant)
- dev.huawei.media.helper (Implant)
Offline data exfiltration via a Wi‑Fi mesh of infected phones
The most unusual aspect of Manic Android malware is how it can exfiltrate information even when the victim device is unable to connect directly to attacker-controlled infrastructure. The malware introduces a store-and-forward relay concept that uses nearby compromised devices as intermediaries.
In practical terms, if the infected “source” phone cannot reach the command-and-control (C2) server, Manic tries to locate another infected Android device that has internet access. That peer can then forward queued data onward, effectively turning a cluster of nearby infected phones into a relay path.
The reported relay workflow works like this:
- Collected files and command results are staged in an encrypted format and stored in a local queue
- The malware searches for an infected nearby peer using methods such as Wi‑Fi Direct, Bluetooth RFCOMM, or BLE GATT
- If a peer is found, the encrypted package is relayed to it and then forwarded toward the C2 server
Researchers also report support for multi-hop routes. By default, items can be configured for up to four relay hops, and each queued item includes metadata that tracks the current hop count.
If no peers are discovered, data remains in the queue and the process is retried later. ThreatFabric further notes that an online peer can create a Wi‑Fi Direct group when it finds no peers, and the network name used for attempts remains consistent across retained builds. Attempts are retried multiple times as part of this group-creation strategy.
This design matters because it changes the assumptions behind “offline” containment. Simply disconnecting a compromised phone from the internet does not necessarily stop exfiltration, since Manic can leverage another infected device nearby as a gateway.
Persistence and command handling keep the system running
To sustain its operations, Manic uses background execution mechanisms such as background workers and alarms, along with the same accessibility and notification services used for monitoring and input capture. ThreatFabric describes these components as maintaining C2 communication, processing commands, uploading queued data, and coordinating offline mesh synchronization.
Execution frequency is reported as periodic—typically every 10 to 15 minutes depending on the build—helping the malware repeatedly attempt data handling, relay discovery, and follow-on commands.
Why Manic’s evolution matters
The observed development changes between May and July 2026—including enhanced anti-analysis safeguards and improved ability to obtain secrets through phishing—suggest the operators are actively refining the threat. For defenders, that implies Manic should be treated as an evolving platform rather than a one-off banking trojan.
Conclusion: a broader threat with a new relay concept
Manic Android malware combines financial-fraud targeting with spyware-like surveillance features, including accessibility abuse, notification monitoring, screen observation, and PIN or secret theft via overlay techniques. Its standout capability is the store-and-forward relay mechanism that can exfiltrate data using nearby infected devices, even when the originating phone is offline.
For organizations and users, the key takeaway is that defensive strategies must account for both direct mobile compromise and “indirect” data movement through device-to-device relays—especially in environments where infected devices may end up physically close to one another.
Source: https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
