Manic: Blend between Banking Malware & Spyware

ThreatFabric's Mobile Threat Intelligence (MTI) Team has identified a new Android threat actively distributed in the wild.

The modern mobile threat landscape includes numerous malware families operated by individual threat actors and organised criminal groups, all competing for ways to infect victims as smoothly and inconspicuously as possible. Manic sits at the intersection of Android banking malware and mobile spyware , combining financial-fraud capabilities with broader surveillance and device-control features. Its targeting is strongly focused on Ukraine , covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.

This article examines Manic, a newly identified Android malware family with broad surveillance and remote-control capabilities. Beyond targeting sensitive applications and enabling extensive device takeover, Manic introduces an unusual Wi‑Fi mesh technique that allows compromised devices to relay data through other infected phones with Internet access.

Our investigation traces Manic’s activity back to February 2026, when the first associated infrastructure was registered. Development and production services followed in late March and April, with the first retained wrapper and implant appearing by late May. The operation evolved quickly from there: infrastructure expanded, the original development environment was gradually abandoned, and a second deployment was prepared. By July, an updated wrapper introduced stronger anti-analysis checks, in-memory DEX loading, and lock-secret phishing, while the new deployment brought an additional panel and API online.

Manic monitors 169 package IDs associated with banks, payment services, cryptocurrency wallets and exchanges, messaging apps, government and eID services, browsers, and email clients. Most targets are Ukrainian, but the list also includes apps used in Russia, Central and Western Europe, and the UK, as well as global fintech and cryptocurrency services.

Here is a table listing its main targets:

Identity / state apps

P2P / BNPL / remittance

Notifications and file collection

Major commercial messengers and military focused messengers

The target set suggests a blend of banking malware and spyware . Financial fraud appears to be a major objective, with coverage spanning banks, payment services, cryptocurrency exchanges and wallets, government identity apps, and authenticators.

At the same time, the targeting extends beyond financial applications to commercial and military-focused messaging apps , browsers, and email. Combined with spyware capabilities such as location tracking, notification monitoring, file collection, and remote device surveillance , this gives operators visibility into both a victim’s financial activity and broader communications.

Manic combines several capabilities into a complete fraud workflow, giving operators progressively greater control over an infected device. After obtaining Accessibility and notification access, the malware can capture the victim’s lock secret and use overlays or fake screens to conceal activity. Within banking and cryptocurrency applications, it can intercept keypad interactions and collect sensitive information such as passwords, one-time codes, and recovery phrases while the victim continues interacting with the legitimate app.

Manic uses its Accessibility service as a UI keylogger . It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text. Each key log record includes the app and package, captured text, timestamp, whether the input came from Autofill or manual entry, and whether the app is on Manic's target list

SMS and notification access provide additional visibility into authentication flows, while WebRTC remote sessions allow the operator to watch the screen and interact with the device remotely abusing Accessibility Services privileges. Collected information is stored locally and uploaded to the infrastructure, with infected peers providing an alternative relay path when the compromised device cannot connect directly.

During remote-control sessions, Manic can conceal activity behind black, fake, or update screens , including overlays that hide permission prompts. The July build also removes the implant from the launcher, relying on the wrapper or a deep link for activation.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build.

Manic uses two separate PIN-related capabilities to steal and re-use the victim's codes: "pinPadOverlay" works inside an open banking app and captures the victim's taps on its real keypad. "autoEnterPin" works at Android's lock screen and attempts to enter a stored credential or pattern. The first records input during banking. The second can give an operator access to a locked phone.

When Manic finds a numeric keypad in a targeted app, pinPadOverlay covers only the combined bounds of those keys and relays each tap to the same coordinates:

When the victim taps the overlay, Manic logs the tap position and the nearby UI element. It then briefly disables touch interception and reproduces the tap at the same position through Accessibility, allowing the real banking app to receive the input and continue normally. Unlike a traditional phishing overlay, Manic does not display a fake banking interface. Instead, it captures input directly from the legitimate app’s keypad.

Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly.

Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure.

Nearby infected devices can communicate using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT . Manic first attempts to use an established Wi-Fi Direct peer, then queries Bluetooth and BLE peers to determine whether they have internet connectivity. If necessary, the malware can also use multi-hop routes, with newly queued items configured for a maximum of four relay hops by default.

If a suitable peer is found, the encrypted package is transferred to it and forwarded toward the C2 server. If no route is available, the package remains queued and Manic retries later. As a result, removing direct internet access from an infected device does not necessarily prevent data exfiltration , as another infected phone within radio range may act as its gateway.

Manic is an evolving Android fraud platform designed for Device Takeover (DTO) , combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine. This combination gives operators the tools to observe and interact with financial sessions directly from a compromised device.

A particularly distinctive capability is its offline mesh relay , which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable. The evolution observed between May and July 2026, including stronger anti-analysis measures and lock-secret phishing, indicates that Manic remains under active development and continues to expand its capabilities.

80be0942d0e20b5006e240434f42512c8b3cd0d54eee858a25663c1a4224a576

tech.intel.dialer.updater

feea425cde1223fe7afdd7a1ea631678ec6282f6cc20c3d3c0fb97cdbcf65b9b

org.lenovo.storage.processor

e7abc375f24d0dd2419e0bce4686c7301b3ee82ae38906c67d3481580f6c648e

tech.apple.dialer.scheduler

7c12f1237090e32c18583f66f1a9e44b029ad7c1e61179e1d524fb3093abd59a

io.motorola.secure.executor

2884108b35eba7b8099087405653c1b23c3839f0d5058c4d61341fc31cfc6040

org.honor.secure.helper

2fb5b01ea5a483d60b659e85327a53c6661bdd630d4afd93dc5fe0941d3ccbbe

dev.huawei.media.helper

Starts a live screen or front-camera session in WebRTC, screenshot or accessibility-component mode.

Packages the accessibility activity log for return.

Returns current coordinates, accuracy and timestamp.

Captures and returns a screen image when MediaProjection is active.

Exports stored SMS data.

Exports call history.

Exports contacts and associated details.

Exports captured notification/push logs.

Exports the installed-application list.

Selects matching local files, archives them and returns the result.

Sends operator-supplied text to a supplied telephone number.

Executes a supplied USSD code through TelephonyManager.

Displays an operator-supplied local notification.

Downloads a server-hosted file by key and writes it to a chosen local path/name.

Deletes a selected local file.

Locks the screen through the accessibility service on supported Android versions.

Attempts to enable device location through automated settings interaction.

Attempts to disable Google Play Protect through UI automation.

Drives runtime, notification-listener, all-files, overlay and battery-exemption permission flows.

Rebuilds and patches filesystem, permission and credential state to the server.

Fetches and applies the latest app_config.json.

Present but explicitly returns “not supported”; device-admin reset logic was removed.

No-operation/success placeholder in the dispatcher.