ThreatFabric's Mobile Threat Intelligence (MTI) Team has identified a new Android threat actively distributed in the wild.

The modern mobile threat landscape includes numerous malware families operated by individual threat actors and organised criminal groups, all competing for ways to infect victims as smoothly and inconspicuously as possible. Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features. Its targeting is strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.

This article examines Manic, a newly identified Android malware family with broad surveillance and remote-control capabilities. Beyond targeting sensitive applications and enabling extensive device takeover, Manic introduces an unusual Wi‑Fi mesh technique that allows compromised devices to relay data through other infected phones with Internet access.

Key Takeaways:

• A new Android malware family is appearing on the threat landscape.
• Broad targeting interests, including government institutions, banking applications and cryptocurrency wallets.
• Extensive Device Takeover (DTO) and interactive remote-control capabilities.
• Advanced PIN stealing techniques that do not require overlay attacks
• A distinctive Wi‑Fi mesh egress technique for relaying data through nearby infected devices.
  
  

The Timeline

Our investigation traces Manic’s activity back to February 2026, when the first associated infrastructure was registered. Development and production services followed in late March and April, with the first retained wrapper and implant appearing by late May. The operation evolved quickly from there: infrastructure expanded, the original development environment was gradually abandoned, and a second deployment was prepared. By July, an updated wrapper introduced stronger anti-analysis checks, in-memory DEX loading, and lock-secret phishing, while the new deployment brought an additional panel and API online.

Manic monitors 169 package IDs associated with banks, payment services, cryptocurrency wallets and exchanges, messaging apps, government and eID services, browsers, and email clients. Most targets are Ukrainian, but the list also includes apps used in Russia, Central and Western Europe, and the UK, as well as global fintech and cryptocurrency services.

Here is a table listing its main targets:

The target set suggests a blend of banking malware and spyware. Financial fraud appears to be a major objective, with coverage spanning banks, payment services, cryptocurrency exchanges and wallets, government identity apps, and authenticators.

At the same time, the targeting extends beyond financial applications to commercial and military-focused messaging apps, browsers, and email. Combined with spyware capabilities such as location tracking, notification monitoring, file collection, and remote device surveillance, this gives operators visibility into both a victim’s financial activity and broader communications.

Capabilities and Modus Operandi

Data stealer and Device Takeover (DTO)

Manic combines several capabilities into a complete fraud workflow, giving operators progressively greater control over an infected device. After obtaining Accessibility and notification access, the malware can capture the victim’s lock secret and use overlays or fake screens to conceal activity. Within banking and cryptocurrency applications, it can intercept keypad interactions and collect sensitive information such as passwords, one-time codes, and recovery phrases while the victim continues interacting with the legitimate app.

Manic uses its Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text. Each key log record includes the app and package, captured text, timestamp, whether the input came from Autofill or manual entry, and whether the app is on Manic's target list 

SMS and notification access provide additional visibility into authentication flows, while WebRTC remote sessions allow the operator to watch the screen and interact with the device remotely abusing Accessibility Services privileges. Collected information is stored locally and uploaded to the infrastructure, with infected peers providing an alternative relay path when the compromised device cannot connect directly. 

During remote-control sessions, Manic can conceal activity behind black, fake, or update screens, including overlays that hide permission prompts. The July build also removes the implant from the launcher, relying on the wrapper or a deep link for activation.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build.

Seeing through the locking mechanism

Manic uses two separate PIN-related capabilities to steal and re-use the victim's codes: "pinPadOverlay" works inside an open banking app and captures the victim's taps on its real keypad. "autoEnterPin" works at Android's lock screen and attempts to enter a stored credential or pattern. The first records input during banking. The second can give an operator access to a locked phone.

When Manic finds a numeric keypad in a targeted app, pinPadOverlay covers only the combined bounds of those keys and relays each tap to the same coordinates:

When the victim taps the overlay, Manic logs the tap position and the nearby UI element. It then briefly disables touch interception and reproduces the tap at the same position through Accessibility, allowing the real banking app to receive the input and continue normally. Unlike a traditional phishing overlay, Manic does not display a fake banking interface. Instead, it captures input directly from the legitimate app’s keypad.

Device-to-device relay

Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly.

Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure.

Nearby infected devices can communicate using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. Manic first attempts to use an established Wi-Fi Direct peer, then queries Bluetooth and BLE peers to determine whether they have internet connectivity. If necessary, the malware can also use multi-hop routes, with newly queued items configured for a maximum of four relay hops by default.

If a suitable peer is found, the encrypted package is transferred to it and forwarded toward the C2 server. If no route is available, the package remains queued and Manic retries later. As a result, removing direct internet access from an infected device does not necessarily prevent data exfiltration, as another infected phone within radio range may act as its gateway.

Conclusion

Manic is an evolving Android fraud platform designed for Device Takeover (DTO), combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine. This combination gives operators the tools to observe and interact with financial sessions directly from a compromised device.

A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable. The evolution observed between May and July 2026, including stronger anti-analysis measures and lock-secret phishing, indicates that Manic remains under active development and continues to expand its capabilities.

Appendix

Indicators of Compromise

Bot commands