A new Android malware threat, codenamed Manic, has been identified as a significant risk, particularly for Ukrainian banks, government services, and messaging applications. Its reach extends to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels.
Technical Insights
According to a technical report from ThreatFabric, Manic represents a convergence of Android banking malware and mobile spyware, merging capabilities for financial fraud with extensive surveillance and device control features. The malware not only targets sensitive applications but also enables comprehensive device takeover through innovative techniques.
One of the standout features of Manic is its novel Wi-Fi mesh technique, allowing infected devices to relay data through nearby compromised devices that have internet access. This sophisticated distribution method utilizes phishing sites and dropper apps that masquerade as legitimate utilities.
The origins of this malware can be traced back to February 2026, when the first domain was registered under a fictitious identity. Shortly thereafter, development efforts intensified, leading to the first wrapper using a booking app as bait, with the implant surfacing by late May. However, an intriguing pause in activity occurred from late June to mid-July, followed by signs of a second deployment around July 13, featuring enhanced anti-analysis checks and capabilities to capture lock screen secrets.
The APK package names associated with the wrapper and implant include:
- tech.intel.dialer.updater (Wrapper)
- org.honor.secure.helper (Wrapper)
- org.lenovo.storage.processor (Implant)
- dev.huawei.media.helper (Implant)
Upon examination, the malware is found to monitor a staggering 169 package IDs linked to banks, peer-to-peer payment services, Buy Now, Pay Later options, cryptocurrency wallets and exchanges, messaging applications, government identity services, and email clients. While the majority of these targets are Ukrainian, the malware also affects applications utilized in Russia, Central and Western Europe, and the U.K.
ThreatFabric highlights that the target set indicates a blend of banking malware and spyware, with financial fraud as a primary objective, encompassing banks, payment services, cryptocurrency exchanges, and identity applications.
Operational Mechanisms
In addition to its financial targets, Manic is engineered to infiltrate commercial and military messaging applications. Its capabilities include location tracking, notification monitoring, file collection, and remote device surveillance, enabling operators to monitor victims’ financial activities and communications in real-time.
Similar to other Android malware families, Manic exploits Android’s accessibility services and notification permissions, allowing it to capture lock screen secrets or present fake overlays to extract sensitive data while obscuring malicious actions.
Some notable features of Manic include:
- Interception of keypad interactions to collect passwords, one-time codes, and recovery phrases
- Utilization of accessibility services as a “UI keylogger” to classify and record text along with the corresponding app
- Remote interaction with the device over a WebRTC session
- Removal of the implant from the launcher
- Recording of current coordinates and timestamps
- Taking screenshots
- Exporting contacts, call history, SMS messages, and notifications
- Compiling a list of installed applications
- Sending SMS messages to specified numbers
- Displaying counterfeit notifications
- Deleting selected local files
- Locking the screen via accessibility services
- Attempting to disable Google Play Protect through UI automation
Manic’s ability to capture PIN codes is particularly alarming; it does so by overlaying a transparent screen atop the legitimate numeric keypad in targeted applications. When a user interacts with this overlay, the malware records the tap position and replicates it on the actual keypad, thus capturing sensitive information without displaying a fraudulent banking interface.
ThreatFabric notes that the malware’s persistence relies on background workers, alarms, and accessibility and notification services, ensuring continuous command and control communication, data processing, and synchronization every 10 to 15 minutes, depending on the build.
Data Exfiltration Techniques
Perhaps the most distinctive feature of Manic is its store-and-forward relay mechanism, which facilitates data exfiltration through nearby compromised devices when direct internet connection is unavailable. This innovative approach allows the source device to remain offline while seeking out another infected device to serve as a conduit to the command-and-control server.
The relay process operates as follows:
- Collected files and command results are staged in an encrypted format and queued locally
- The malware searches for a nearby infected peer using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT
- If a peer is found, the encrypted package is relayed to it and subsequently forwarded to the command-and-control server
Manic supports multi-hop routes, allowing for up to four relay hops by default. If no peers are detected, the data remains queued for future attempts. This means that disconnecting an infected device from the internet does not necessarily halt data exfiltration, as another compromised Android device can be leveraged as a gateway.
The evolution observed in Manic’s capabilities, particularly between May and July 2026, suggests ongoing development and an expansion of its functionalities, including enhanced anti-analysis measures and lock-screen phishing techniques.
Update
In response to the emergence of this threat, a Google spokesperson stated, “Based on our current detection, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.”
(The story was updated after publication on August 21, 2026, to include a response from Google.)
