A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.
"Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features," ThreatFabric said in a technical report shared with The Hacker News.
The malware, besides targeting sensitive applications and enabling extensive device takeover, introduces a novel Wi‑Fi mesh technique that makes it possible for the infected devices to relay data through nearby compromised devices with internet access. It's distributed via phishing sites and dropper apps impersonating utilities.
The Dutch security company said the malware family's activity dates back to February 2026, when the first domain was registered with a fabricated persona. Active development efforts ensued not long after, with the first wrapper using a booking app lure and the implant appearing by the end of May.
But in an interesting twist, these efforts were abandoned from late June to mid-July, while signs of a second deployment emerged around July 13. The newer iteration of the wrapper and the implant have been found to incorporate stronger anti-analysis checks and the ability to phishing lock screen secrets. A corresponding panel and API subsequently went live between July 24 and 28.
The APK package names linked to the wrapper and implant are below -
- tech.intel.dialer.updater (Wrapper)
- org.honor.secure.helper (Wrapper)
- org.lenovo.storage.processor (Implant)
- dev.huawei.media.helper (Implant)
An examination of the malware reveals that it monitors 169 package IDs associated with banks, peer-to-peer (P2P) payment and Buy Now, Pay Later (BNPL) services, cryptocurrency wallets and exchanges, messaging apps, government and eID services, browsers, authenticators, and email clients. The majority of the targets are Ukrainian, but also present in the list are apps used in Russia, Central and Western Europe, and the U.K.
"The target set suggests a blend of banking malware and spyware," ThreatFabric noted. "Financial fraud appears to be a major objective, with coverage spanning banks, payment services, cryptocurrency exchanges and wallets, government identity apps, and authenticators."
In tandem, Manic is also designed to target commercial and military-focused messaging apps. Because the malware facilitates location tracking, notification monitoring, file collection, and remote device surveillance, the broad targeting allows the operator to keep tabs on a victim's financial activity, communications, and their whereabouts in real-time.
Like other Android malware families, Manic achieves its goals by abusing Android's accessibility services and notification permissions, effectively allowing it to capture lock screen secrets or serve fake overlays to gather sensitive data or conceal malicious activity by showing black or update screens.
Some of the other noteworthy features of the malware are listed below -
- Intercept keypad interactions and collect passwords, one-time codes, and recovery phrases
- Leverage accessibility services as a "UI keylogger" to classify and record text along with the app used, and if that app is on the malware's target list
- Monitor the screen and interact with the device remotely over a WebRTC session
- Remove the implant from the launcher
- Record current coordinates and timestamp (and enable device location, if not already)
- Take screenshots
- Export contacts, call history, SMS messages, and notifications
- Obtain a list of installed apps
- Send SMS to a supplied telephone number along with the provided text
- Display bogus notifications
- Delete a selected local file
- Lock the screen through the accessibility service
- Attempt to disable Google Play Protect through UI automation
On top of these capabilities, Manic can capture PIN codes by serving a transparent overlay atop the legitimate numeric keypad in the targeted app. Thus, when a user taps on the overlay, the malware records the exact tap position and the nearby UI element. It then briefly turns off touch interception and proceeds to replicate the tap on the actual keypad at the same position by taking advantage of the accessibility services API.
This, in turn, allows the targeted app to function normally, while the threat actor is in possession of the PIN code without having to display a fake banking interface.
"Persistence relies on background workers, alarms, and the Accessibility and notification services," ThreatFabric said. "These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build."
Perhaps the most unusual aspect of Manic is its store-and-forward relay mechanism to exfiltrate data using another device that's in close physical proximity to the compromised Android phone if it cannot connect to the attacker-controlled infrastructure.
With this approach, the idea is to allow the source device to remain offline while the malware attempts to locate a second infected device that can provide an alternative pathway to the command-and-control (C2) server. The relay mechanism works like this -
- The collected files and command results are staged in an encrypted format and placed in a local queue
- Find an infected peer nearby using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT
- If a peer is located, the encrypted package is relayed to it and forwarded toward the C2 server
Manic also supports multi-hop routes, enabling the queued items to be configured for a maximum of four relay hops by default. If no peers are found, the data is kept in the queue, and the whole process is retried later.
"Each newly queued item receives a four-hop relay limit by default, although the configuration can change that value," ThreatFabric told The Hacker News. "The relay metadata also carries the current hop count. An online peer can create a Wi‑Fi Direct group when it finds no peers. Every retained build uses the same network name and tries to create the group up to three times."
This also means that disconnecting an infected device from the internet does not necessarily prevent data exfiltration, as Manic can weaponize another compromised Android device as a gateway.
"The evolution observed between May and July 2026, including stronger anti-analysis measures and lock-secret phishing, indicates that Manic remains under active development and continues to expand its capabilities," ThreatFabric said.