Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
Manic is a novel Android malware combining banking fraud capabilities with spyware features, actively targeting Ukrainian and European financial, government, and military communication services since February 2026 It introduces a unique Wi-Fi mesh store-and-forward relay mechanism that enables data exfiltration from offline/air-gapped devices by hopping through nearby infected peers using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT (up to four hops) The malware abuses Android accessibility servi
Analysis
TL;DR
- Manic is a novel Android malware combining banking fraud capabilities with spyware features, actively targeting Ukrainian and European financial, government, and military communication services since February 2026
- It introduces a unique Wi-Fi mesh store-and-forward relay mechanism that enables data exfiltration from offline/air-gapped devices by hopping through nearby infected peers using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT (up to four hops)
- The malware abuses Android accessibility services as a "UI keylogger," captures PINs via transparent overlays that replicate taps on real keypads, and monitors 169 package IDs across banking, crypto, messaging, and government apps
- Distribution occurs through phishing sites and dropper apps impersonating legitimate utilities (e.g., tech.intel.dialer.updater, org.honor.secure.helper, org.lenovo.storage.processor, dev.huawei.media.helper)
- The threat actor demonstrated operational sophistication with a development pause (late June to mid-July 2026), followed by a second deployment featuring stronger anti-analysis checks and lock screen secret phishing capabilities
Why It Matters
Manic represents a significant evolution in mobile threat actor capabilities, particularly in its ability to exfiltrate data from devices that are offline or lack internet connectivity — a scenario previously considered relatively safe. For security practitioners and mobile app developers, this underscores the growing importance of understanding peer-to-peer wireless protocols (Wi-Fi Direct, BLE, Bluetooth RFCOMM) as potential attack vectors, not just traditional network-based C2 channels. The blend of financial fraud and surveillance also reflects a broader trend of hybrid malware families designed for maximum data harvest across geopolitical conflict zones.
Technical Details
- Wi-Fi Mesh Relay Mechanism: Data is staged in an encrypted local queue; the malware discovers nearby infected peers via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. Packages are relayed hop-by-hop (default max four hops) toward a C2 server. If no peer is found, data remains queued for retry every 10–15 minutes via background workers and alarms.
- PIN Capture via Transparent Overlay: Manic renders a transparent overlay atop legitimate numeric keypads, records the exact tap coordinates and nearby UI element, then temporarily disables touch interception and replicates the tap on the real keypad using the accessibility services API — capturing the PIN without displaying any fake interface.
- Accessibility Service Abuse: The malware leverages Android accessibility services as a "UI keylogger" to classify and record text input along with the originating app (if on its 169-target list), and also uses them for remote screen monitoring via WebRTC, lock screen locking, and Google Play Protect disabling via UI automation.
- Surveillance & Data Exfiltration Capabilities: Includes location tracking with timestamps, screenshots, contact/SMS/notification/call history export, file collection and deletion, remote SMS sending, bogus notification display, and launcher removal for stealth.
- Persistence & Anti-Analysis: Relies on background workers, alarms, and accessibility/notification services for C2 communication and mesh synchronization. The second deployment iteration (post-July 2026) incorporated stronger anti-analysis checks to resist sandboxing and reverse engineering.
Industry Insight
- Mobile security solutions must expand threat detection beyond traditional network-based C2 channels to include local wireless protocol monitoring (Wi-Fi Direct, BLE, Bluetooth RFCOMM), as these are now proven exfiltration pathways for offline device compromise.
- The transparent overlay PIN-capture technique bypasses many existing overlay-detection defenses; app developers and security vendors should implement integrity verification of UI touch event chains and consider hardware-backed input validation for sensitive fields.
- The hybrid banking-spyware model targeting conflict-zone infrastructure suggests state-adjacent or financially motivated threat actors are increasingly investing in resilient, multi-vector mobile malware; organizations operating in or transacting with Eastern Europe should prioritize mobile device monitoring, restrict accessibility service permissions, and enforce strict app installation policies.
Disclaimer: The above content is generated by AI and is for reference only.