Threat reportMalwareTL-2026-3594
Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)
Manic: Android Malware Blending Banking Trojan and Spyware (TL-2026-3594) is a high-severity malware campaign, first published 2026-10-15. It has no confirmed attribution, affects Google Android (user devices; targeted apps include banking, payment, maps to 15 MITRE ATT&CK techniques (T1417.001, T1417.002, T1430), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3594
- Threat ID
- TL-2026-3594
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, government administration, cryptocurrency, telecoms, military
- Target regions
- ukraine, russia, poland, Czech Republic, slovakia, austria, germany, france, spain, netherlands, estonia, lithuania
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Manic: Android Malware Blending Banking Trojan and Spyware
Malware and tooling: Manic, RemoteControl
How Manic: Android Malware Blending Banking Trojan and Spyware works
ThreatFabric's Mobile Threat Intelligence team reports Manic, an Android malware family that combines banking-fraud capabilities (WebRTC device takeover, overlay-based PIN capture, accessibility keylogging) with spyware features (SMS/notification/call/contact export, location tracking, file collection, screenshots). It introduces an offline relay (mesh egress) that passes exfiltrated data through nearby infected phones over Wi-Fi Direct, Bluetooth RFCOMM or BLE GATT. Primary targeting is Ukraine.
Manic is an Android malware family documented by ThreatFabric on 2026-08-20. It sits between mobile banking malware and mobile spyware. It monitors 169 package IDs covering banks, payment and P2P apps, BNPL services, cryptocurrency exchanges and wallets, government eID services, authenticators, commercial and military messengers, browsers and email clients. Primary targeting is Ukraine; secondary targets are Russia, Poland, Czech Republic, Slovakia, Austria, Germany, France, Spain, Netherlands, Estonia, Lithuania and the United Kingdom.
Delivery and staging: the sources describe phishing sites and dropper apps impersonating utilities. A first wrapper used a booking-app lure in May 2026. Wrapper APKs masquerade under vendor-like package names (tech.intel.dialer.updater, org.honor.secure.helper) and carry the implant (org.lenovo.storage.processor, dev.huawei.media.helper, tech.apple.dialer.scheduler, io.motorola.secure.executor). The July 2026 build adds stronger anti-analysis checks, in-memory DEX loading and lock-screen secret phishing. The malware attempts to bypass Google Play Protect through UI automation (a disable_gp command exists).
Fraud and surveillance: the Accessibility service is used as a UI keylogger that classifies input by type (lock-screen secrets, recovery phrases, OTP codes, passwords) and records the source package and timestamp. A 'pinPadOverlay' technique places a transparent overlay on the legitimate numeric keypad of a targeted app, records tap coordinates and the nearby UI element, then stops intercepting and replays the tap to the real app through Accessibility, so no fake banking screen is shown. 'autoEnterPin' abuses the lock screen. Remote control of the device (screen viewing and interaction, fake/black screen overlays, camera access) runs over WebRTC. The malware exports SMS, calls, contacts, push notifications, installed apps and files, and tracks location. The source lists 28 bot commands, including remote_control, get_logs, location, screenshot, export_sms, export_calls, export_contact, export_push, export_apps, export_file, send_sms, ussd, send_push, send_file, delete_file, force_lock, geo, disable_gp, get_more_rights, refresh, reload_config and reset_password.
Mesh egress: devices without direct C2 connectivity queue AES-GCM-encrypted data and relay it via nearby infected devices that have internet access, using Wi-Fi Direct, Bluetooth RFCOMM or BLE GATT, with up to four relay hops by default (store-and-forward). Disconnecting a single device from the network therefore does not by itself stop exfiltration. Persistence relies on background workers, alarms, and the Accessibility and notification services, with periodic execution every 10-15 minutes.
Infrastructure and development timeline: first infrastructure was registered in February 2026; development/production services appeared late March to April; the first wrapper and implant appeared in late May; development paused from late June to mid-July; a second deployment emerged on 2026-07-13; and the panel and API were deployed between 24 and 28 July 2026. ThreatFabric did not name a threat actor, did not detail the infection chain beyond phishing/dropper lures, and published no domains, IPs or C2 URLs, so there are no network IOCs to correlate in BeaconBeagle. The severity is analyst-assigned; no CVSS or CVE is associated.
MITRE ATT&CK techniques used in TL-2026-3594
Collection
T1417.001 Keylogging; T1430 Location Tracking; T1512 Video Capture; T1513 Screen Capture; T1517 Access Notifications; T1533 Data from Local System; T1636.002 Call Log; T1636.003 Contact List; T1636.004 SMS Messages
Credential Access
Defense Evasion
T1516 Input Injection; T1629.003 Disable or Modify Tools; T1655.001 Match Legitimate Name or Location
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in Manic: Android Malware Blending Banking Trojan and Spyware
- Google — Android (user devices; targeted apps include banking, payment, crypto, government eID, messenger, authenticator, browser and email apps)
Vulnerable versions: Devices on which the malicious APKs are installed and granted Accessibility/notification permissions
Remediation for Manic: Android Malware Blending Banking Trojan and Spyware
Immediate actions
- Block or alert on installation of the published package names and SHA-256 hashes via MDM/EMM and mobile threat defense
- Hunt for devices with unknown apps holding Accessibility, notification-listener, and overlay permissions
- For suspected infections, isolate the device and rotate banking, messenger, and crypto credentials and recovery phrases from a clean device
- Do not rely on network disconnection alone: Manic can relay data over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT
Workarounds
- Install apps only from official stores
- Be cautious with Accessibility permission requests, especially from apps posing as dialer, updater, or storage utilities
- Periodically verify Google Play Protect status
Longer-term hardening
- Enforce Play Protect and block sideloading from unknown sources on managed devices
- Restrict Accessibility service grants to an allowlist of vetted apps
- Deploy mobile threat defense capable of detecting accessibility abuse, overlay abuse, and in-memory DEX loading
- Banks: add device-integrity and remote-access/WebRTC-session risk signals to fraud engines
Timeline of Manic: Android Malware Blending Banking Trojan and Spyware
- First Manic-associated infrastructure registered in February 2026 (month-level date per ThreatFabric)
- Development/production services appear between late March and April 2026 (approximate date)
- First wrapper (booking-app lure) deployed in May 2026 and implant appears in late May (org.honor.secure.helper / dev.huawei.media.helper, approximate date)
- Development pause from late June to mid-July 2026 (approximate start date)
- Second deployment emerges; July build adds stronger anti-analysis, in-memory DEX loading and lock-secret phishing
- Panel and API deployed between 24 and 28 July 2026
- ThreatFabric MTI publishes 'Manic: Blend between Banking Malware & Spyware'
Sources cited for Manic: Android Malware Blending Banking Trojan and Spyware
- Manic: Blend between Banking Malware & Spyware (ThreatFabric)
- Manic Android Malware Exfiltrates Data (The Hacker News)
- Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline (Security Affairs)
- New Manic Android Malware Uses Offline Networks to Drain Bank Accounts (eSecurity Planet)
- New Android malware blurs the line between banking trojan and spyware (Cybernews)
- Manic Android Malware (Cyber Security News)
Detection coverage for TL-2026-3594
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3594 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.