Full research report

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Manic materially advances mobile threat tradecraft through its AES-GCM encrypted peer-to-peer relay capability, which removes direct internet isolation as a viable defensive control — an infected device within radio range of another infected device can exfiltrate data regardless of whether it has independent connectivity. ThreatFabric's primary research confirmed active in-the-wild distribution from at least February 2026, with continuous infrastructure development culminating in new command panels and APIs in late July, indicating a well-resourced and actively maintained operation. The malware's strong targeting of Ukrainian banking and government eID applications, alongside military messaging platforms and global crypto services, is consistent with either financially motivated crime or a politically motivated actor with financial-theft as a secondary objective, though no attribution has been made. The infection vector of phishing sites and dropper apps impersonating device utilities is reported by The Hacker News and consistent with the sideloading-dependent permission model, but is not explicitly stated in ThreatFabric's own report, representing the primary evidence gap. Defenders should treat the known package-name IOCs and AV detection signatures as immediate hunt priorities across managed Android fleets, with particular urgency for organisations operating in the financial, government, and cryptocurrency sectors across Eastern and Central Europe.

What happened

ThreatFabric published analysis of Manic, an Android malware family active since at least February 2026 that combines banking trojan, spyware, and remote access capabilities in a single implant. The malware targets at least 169 apps across banking, government identity, payment, cryptocurrency, messaging, and authenticator categories, with Ukraine as its primary focus. Its most technically novel feature is a store-and-forward relay mechanism that exfiltrates AES-GCM encrypted data through nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT when the compromised device cannot reach its command-and-control server directly. Infrastructure expanded materially between May and July 2026, with a new panel and API going live in late July, indicating active and ongoing development.

Affected scope

Android users in Ukraine (primary target, particularly banking and government eID applications), Russia, Poland, Czech Republic, Slovakia, Austria, Germany, France, Spain, Netherlands, Estonia, Lithuania, and the UK. Applications targeted include 169 package IDs spanning national banks, government identity portals, cryptocurrency wallets and exchanges, payment services, messaging apps, and authenticator applications globally.

Technical assessment

Manic abuses the Android Accessibility service as a UI keylogger, deploying transparent overlays on numeric keypads to capture lock-screen PINs and banking credentials without disrupting the legitimate application. After obtaining Accessibility and notification permissions — the central prerequisite for its capabilities — it intercepts SMS one-time passwords, collects files and location data, monitors the screen, and provides live remote control to operators via WebRTC. The defining technical capability is a store-and-forward peer relay: when the infected device cannot reach the C2, stolen data is queued locally in AES-GCM encrypted packages and forwarded through any nearby infected device over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting up to four relay hops. This architecture means severing a device's direct internet access does not prevent exfiltration if another infected device is within radio range.

Recommended defensive actions

  1. Audit all managed Android devices for the known malicious package names: tech.intel.dialer.updater, org.honor.secure.helper, org.lenovo.storage.processor, dev.huawei.media.helper, tech.apple.dialer.scheduler, io.motorola.secure.executor
  2. Enable and verify Google Play Protect is active and not disabled on all managed Android devices, as Manic actively attempts to turn it off
  3. Restrict sideloading of APKs from unofficial sources via Mobile Device Management (MDM) policy and enforce installation exclusively from the Google Play Store
  4. Review and revoke Accessibility permission grants on managed devices; deny Accessibility access to any app not verified as a trusted accessibility tool
  5. Monitor for anomalous Wi-Fi Direct and Bluetooth RFCOMM or BLE GATT activity on mobile endpoints, particularly in high-density environments such as offices or public transport where peer relay is operationally feasible
  6. Subscribe to ThreatFabric threat intelligence or equivalent mobile threat intelligence to receive updated indicators as the malware's infrastructure continues to evolve

Uncertainties and evidence gaps

  • The initial infection vector has not been confirmed in ThreatFabric's own primary report; phishing sites and dropper apps impersonating utilities are reported by The Hacker News but not explicitly stated in the primary source
  • No threat actor or criminal group has been attributed to Manic's development or operation; the Ukraine-centric targeting is consistent with both financially and politically motivated actors
  • The real-world scale of the peer relay network — how many devices participate and how effectively the multi-hop mechanism functions in practice — is not disclosed in available reporting
  • No government or law-enforcement advisory (CISA, ENISA, NCSC, CERT-UA) has been published at the time of this report, leaving the official response picture incomplete

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser-initiated installation of a sideloaded APK delivered via phishing site or dropper app impersonating a device utility, followed by the user granting Accessibility service and notification access permissions
ComponentAndroid Accessibility service, notification listener interface, Wi-Fi Direct and Bluetooth RFCOMM/BLE GATT subsystems
MechanismMalicious APK masquerades as a legitimate device utility; after permission grants, the Accessibility service is abused as a UI keylogger via transparent overlays on numeric keypads; collected data is AES-GCM encrypted and queued for relay through peer infected devices over short-range radio protocols when C2 is unreachable
ImpactFull credential and session theft covering banking PINs, OTPs, passwords, and cryptocurrency recovery phrases; live remote device control; exfiltration of SMS, contacts, call history, files, and location data; persistence even when the device's direct internet access is severed
DetectionPresence of known malicious package names (see defensive actions); anomalous Accessibility service grants to non-accessibility-category apps; unexpected Wi-Fi Direct or Bluetooth RFCOMM or BLE activity outside normal pairing contexts; AV detections: Android/Spy.Agent.GEV (ESET-NOD32), AdLibrary:Generisk (Symantec), Ti!E7ABC375F24D (McAfee), Android.Riskware.Agent.gHXVJ (Combo Cleaner)
MitigationRemove identified malicious packages; revoke Accessibility and notification listener permissions; enforce Play Protect; restrict sideloading via MDM policy; no OS-level patch is applicable as no OS vulnerability is exploited — the malware relies entirely on permission misuse
Exploitation status

No confirmed active exploitation by a named threat actor; Manic has been observed distributed in the wild via phishing sites and dropper apps since at least February 2026, with active infrastructure expansion through July 2026.

Research process

Investigation opened with the two supplied outlets to establish the core claims, then moved to ThreatFabric's primary blog post as the authoritative technical source. CyberSecurityNews and PCRisk provided independent corroboration and AV detection names. A search for government advisories (CISA, CERT-UA) returned no results, confirming that gap. Four independent source domains now consistently describe the same event and mechanism, supporting high confidence in the technical characterisation while preserving the confirmed gaps around actor attribution and infection vector.

  1. What do the supplied outlets report about Manic malware?
    Fetched BleepingComputer article in full
    bleepingcomputer.com ↗

    Confirmed malware name, discovery by ThreatFabric, activity since February 2026, targeting of 169 apps with Ukraine as primary focus, peer relay via Wi-Fi Direct and Bluetooth with up to four hops, and WebRTC remote control. No CVEs or actor attribution.

    why Established the core factual claims requiring verification and identified ThreatFabric as the primary research source to pursue.

  2. Does The Hacker News add corroborating or contradicting technical detail?
    Fetched The Hacker News article in full
    thehackernews.com ↗

    Independently confirmed all core capabilities, geographic scope, and relay mechanism. Added infection vector detail — phishing sites and dropper apps impersonating utilities — and specific package name IOCs not prominent in the BleepingComputer piece.

    why Two independent outlets confirming the same technical claims raises confidence. The infection vector detail from THN requires cross-checking against the ThreatFabric primary source.

  3. What does ThreatFabric's primary report say, and does it confirm the infection vector?
    Fetched ThreatFabric blog post
    threatfabric.com ↗

    Confirmed AES-GCM encrypted relay via Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT; provided package-name IOCs; confirmed timeline from February to July 2026. Infection vector is described only as distributed 'in the wild' — not explicitly confirmed in the primary source.

    why Primary source is most authoritative. The infection vector via phishing and dropper apps is a credible claim from THN but cannot be treated as confirmed fact from ThreatFabric's own writing.

  4. Is there independent third-party corroboration from a third domain?
    Fetched CyberSecurityNews article
    cybersecuritynews.com ↗

    Third independent outlet confirmed all core capabilities and relay mechanism with no contradicting information. Consistent with ThreatFabric's account.

    why Three independent domains now confirm the same event with consistent technical detail, satisfying the corroboration requirement for medium-to-high confidence.

  5. Are AV detection names or additional IOCs available for defenders?
    Fetched PCRisk removal guide
    pcrisk.com ↗

    AV detection names confirmed: ESET-NOD32 (Android/Spy.Agent.GEV), McAfee (Ti!E7ABC375F24D), Symantec (AdLibrary:Generisk), Combo Cleaner (Android.Riskware.Agent.gHXVJ). Infection vector described as unconfirmed, consistent with ThreatFabric's position.

    why Detection names are immediately actionable for defenders running endpoint security on managed Android fleets, providing concrete hunt value even in the absence of CVE assignment.

  6. Has any government body (CISA, ENISA, CERT-UA) issued an advisory on Manic?
    Searched for CISA or government advisory referencing Manic Android malware and Ukraine banking trojan

    No government advisory found. Search results returned only the same press and research coverage already reviewed.

    why Confirmed absence of official government advisory is a material gap, accurately reflected in uncertainties rather than inferred from press coverage.

Named in this story
MalwareManic
TargetsUkrainian banks and national financial institutionsGovernment eID services (Ukraine and Europe)European financial institutions (Poland, Czech Republic, Slovakia, Austria, Germany, France, Spain, Netherlands, Estonia, Lithuania, UK)Cryptocurrency exchanges and walletsMessaging and military communications applications2FA and authenticator applications

Research coverage

All 68 registered source leaves were evaluated for this run: 55 completed, 0 were unavailable, 6 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 53 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok8 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
The Hacker Newsnews ok16 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1673 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: exploitresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: penetration-testingresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: pocresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: vulnerabilityresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vendor & gov advisories1
Manic: Blend between Banking Malware & Spyware threatfabric.com ↗

Primary technical analysis by the discovering research team; most authoritative source on capabilities, IOCs, and timeline

Analysis & research4
New Manic Android malware can exfiltrate data through nearby devices bleepingcomputer.com ↗

First secondary outlet to cover the story; confirms relay mechanism and geographic scope

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices thehackernews.com ↗

Independent coverage adding infection vector detail and specific package-name IOCs

New Android Malware Manic Steals Banking PINs and Relays Data Through Peer Devices cybersecuritynews.com ↗

Third independent outlet corroborating core capabilities and relay mechanism

Manic Malware (Android) - Malware removal instructions pcrisk.com ↗

AV detection names useful as hunt IOCs for defenders running endpoint security on Android fleets