A brand new Android risk codenamed Manic has been noticed actively concentrating on Ukrainian banks, authorities and identification providers, and messaging purposes, in addition to Russian and European monetary establishments, world fintech and cryptocurrency providers, and military-focused communications.
“Manic sits on the intersection of Android banking malware and cell adware, combining financial-fraud capabilities with broader surveillance and device-control options,” ThreatFabric said in a technical report shared with The Hacker Information.
The malware, moreover concentrating on delicate purposes and enabling intensive machine takeover, introduces a novel Wi‑Fi mesh method that makes it attainable for the contaminated units to relay knowledge by way of close by compromised units with web entry. It is distributed via phishing websites and dropper apps impersonating utilities.
The Dutch safety firm stated the malware household’s exercise dates again to February 2026, when the primary area was registered with a fabricated persona. Energetic improvement efforts ensued not lengthy after, with the primary wrapper utilizing a reserving app lure and the implant showing by the top of Might.
However in an attention-grabbing twist, these efforts had been deserted from late June to mid-July, whereas indicators of a second deployment emerged round July 13. The newer iteration of the wrapper and the implant have been discovered to include stronger anti-analysis checks and the power to phishing lock display secrets and techniques. A corresponding panel and API subsequently went stay between July 24 and 28.
The APK package deal names linked to the wrapper and implant are beneath –
- tech.intel.dialer.updater (Wrapper)
- org.honor.safe.helper (Wrapper)
- org.lenovo.storage.processor (Implant)
- dev.huawei.media.helper (Implant)
An examination of the malware reveals that it displays 169 package deal IDs related to banks, peer-to-peer (P2P) cost and Purchase Now, Pay Later (BNPL) providers, cryptocurrency wallets and exchanges, messaging apps, authorities and eID providers, browsers, authenticators, and e mail shoppers. The vast majority of the targets are Ukrainian, but in addition current within the record are apps utilized in Russia, Central and Western Europe, and the U.Ok.
“The goal set suggests a mix of banking malware and adware,” ThreatFabric famous. “Monetary fraud seems to be a serious goal, with protection spanning banks, cost providers, cryptocurrency exchanges and wallets, authorities identification apps, and authenticators.”
In tandem, Manic can be designed to focus on industrial and military-focused messaging apps. As a result of the malware facilitates location monitoring, notification monitoring, file assortment, and distant machine surveillance, the broad concentrating on permits the operator to maintain tabs on a sufferer’s monetary exercise, communications, and their whereabouts in real-time.
Like different Android malware households, Manic achieves its objectives by abusing Android’s accessibility services and notification permissions, successfully permitting it to seize lock display secrets and techniques or serve faux overlays to assemble delicate knowledge or conceal malicious exercise by displaying black or replace screens.
A number of the different noteworthy options of the malware are listed beneath –
- Intercept keypad interactions and accumulate passwords, one-time codes, and restoration phrases
- Leverage accessibility providers as a “UI keylogger” to categorise and document textual content together with the app used, and if that app is on the malware’s goal record
- Monitor the display and work together with the machine remotely over a WebRTC session
- Take away the implant from the launcher
- Report present coordinates and timestamp (and allow machine location, if not already)
- Take screenshots
- Export contacts, name historical past, SMS messages, and notifications
- Acquire a listing of put in apps
- Ship SMS to a provided phone quantity together with the supplied textual content
- Show bogus notifications
- Delete a particular native file
- Lock the display by way of the accessibility service
- Try to disable Google Play Shield by way of UI automation
On prime of those capabilities, Manic can seize PIN codes by serving a clear overlay atop the legit numeric keypad within the focused app. Thus, when a consumer faucets on the overlay, the malware information the precise faucet place and the close by UI ingredient. It then briefly turns off contact interception and proceeds to copy the faucet on the precise keypad on the similar place by benefiting from the accessibility providers API.
This, in flip, permits the focused app to perform usually, whereas the risk actor is in possession of the PIN code with out having to show a faux banking interface.
“Persistence depends on background staff, alarms, and the Accessibility and notification providers,” ThreatFabric stated. “These elements preserve C2 communication, course of instructions, add queued knowledge, and synchronize the offline mesh, with periodic execution each 10 to fifteen minutes relying on the construct.”
Maybe probably the most uncommon side of Manic is its store-and-forward relay mechanism to exfiltrate knowledge utilizing one other machine that is in shut bodily proximity to the compromised Android cellphone if it can’t hook up with the attacker-controlled infrastructure.
With this method, the concept is to permit the supply machine to stay offline whereas the malware makes an attempt to find a second contaminated machine that may present another pathway to the command-and-control (C2) server. The relay mechanism works like this –
- The collected information and command outcomes are staged in an encrypted format and positioned in an area queue
- Discover an contaminated peer close by utilizing Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT
- If a peer is positioned, the encrypted package deal is relayed to it and forwarded towards the C2 server
Manic additionally helps multi-hop routes, enabling the queued objects to be configured for a most of 4 relay hops by default. If no friends are discovered, the info is saved within the queue, and the entire course of is retried later.
“Every newly queued merchandise receives a four-hop relay restrict by default, though the configuration can change that worth,” ThreatFabric instructed The Hacker Information. “The relay metadata additionally carries the present hop depend. A web based peer can create a Wi‑Fi Direct group when it finds no friends. Each retained construct makes use of the identical community identify and tries to create the group as much as 3 times.”
This additionally implies that disconnecting an contaminated machine from the web doesn’t essentially forestall knowledge exfiltration, as Manic can weaponize one other compromised Android machine as a gateway.
“The evolution noticed between Might and July 2026, together with stronger anti-analysis measures and lock-secret phishing, signifies that Manic stays underneath lively improvement and continues to broaden its capabilities,” ThreatFabric stated.
