# Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)

> ThreatFabric's Mobile Threat Intelligence team reports Manic, an Android malware family that combines banking-fraud capabilities (WebRTC device takeover, overlay-based PIN capture, accessibility keylogging) with spyware features (SMS/notification/call/contact export, location tracking, file collection, screenshots). It introduces an offline relay (mesh egress) that passes exfiltrated data through nearby infected phones over Wi-Fi Direct, Bluetooth RFCOMM or BLE GATT. Primary targeting is Ukraine.

- **Published:** 2026-10-15T07:16:05Z
- **Last reviewed:** 2026-10-15T07:16:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3594
- **ID:** TL-2026-3594
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Manic is an Android malware family documented by ThreatFabric on 2026-08-20. It sits between mobile banking malware and mobile spyware. It monitors 169 package IDs covering banks, payment and P2P apps, BNPL services, cryptocurrency exchanges and wallets, government eID services, authenticators, commercial and military messengers, browsers and email clients. Primary targeting is Ukraine; secondary targets are Russia, Poland, Czech Republic, Slovakia, Austria, Germany, France, Spain, Netherlands, Estonia, Lithuania and the United Kingdom.

Delivery and staging: the sources describe phishing sites and dropper apps impersonating utilities. A first wrapper used a booking-app lure in May 2026. Wrapper APKs masquerade under vendor-like package names (tech.intel.dialer.updater, org.honor.secure.helper) and carry the implant (org.lenovo.storage.processor, dev.huawei.media.helper, tech.apple.dialer.scheduler, io.motorola.secure.executor). The July 2026 build adds stronger anti-analysis checks, in-memory DEX loading and lock-screen secret phishing. The malware attempts to bypass Google Play Protect through UI automation (a disable_gp command exists).

Fraud and surveillance: the Accessibility service is used as a UI keylogger that classifies input by type (lock-screen secrets, recovery phrases, OTP codes, passwords) and records the source package and timestamp. A 'pinPadOverlay' technique places a transparent overlay on the legitimate numeric keypad of a targeted app, records tap coordinates and the nearby UI element, then stops intercepting and replays the tap to the real app through Accessibility, so no fake banking screen is shown. 'autoEnterPin' abuses the lock screen. Remote control of the device (screen viewing and interaction, fake/black screen overlays, camera access) runs over WebRTC. The malware exports SMS, calls, contacts, push notifications, installed apps and files, and tracks location. The source lists 28 bot commands, including remote_control, get_logs, location, screenshot, export_sms, export_calls, export_contact, export_push, export_apps, export_file, send_sms, ussd, send_push, send_file, delete_file, force_lock, geo, disable_gp, get_more_rights, refresh, reload_config and reset_password.

Mesh egress: devices without direct C2 connectivity queue AES-GCM-encrypted data and relay it via nearby infected devices that have internet access, using Wi-Fi Direct, Bluetooth RFCOMM or BLE GATT, with up to four relay hops by default (store-and-forward). Disconnecting a single device from the network therefore does not by itself stop exfiltration. Persistence relies on background workers, alarms, and the Accessibility and notification services, with periodic execution every 10-15 minutes.

Infrastructure and development timeline: first infrastructure was registered in February 2026; development/production services appeared late March to April; the first wrapper and implant appeared in late May; development paused from late June to mid-July; a second deployment emerged on 2026-07-13; and the panel and API were deployed between 24 and 28 July 2026. ThreatFabric did not name a threat actor, did not detail the infection chain beyond phishing/dropper lures, and published no domains, IPs or C2 URLs, so there are no network IOCs to correlate in BeaconBeagle. The severity is analyst-assigned; no CVSS or CVE is associated.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Match Legitimate Name or Location
- T1629.003 Disable or Modify Tools
- T1516 Input Injection
- T1417.002 GUI Input Capture
- T1417.002 GUI Input Capture
- T1417.001 Keylogging
- T1513 Screen Capture
- T1517 Access Notifications
- T1430 Location Tracking
- T1533 Data from Local System
- T1636.004 SMS Messages
- T1636.002 Call Log
- T1636.003 Contact List
- T1512 Video Capture
- T1646 Exfiltration Over C2 Channel

## Sources

- [Manic: Blend between Banking Malware & Spyware (ThreatFabric)](https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware)
- [Manic Android Malware Exfiltrates Data (The Hacker News)](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html)
- [Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline (Security Affairs)](https://securityaffairs.com/197570/malware/manic-the-android-malware-that-exfiltrates-data-even-when-the-phone-is-offline.html)
- [New Manic Android Malware Uses Offline Networks to Drain Bank Accounts (eSecurity Planet)](https://www.esecurityplanet.com/threats/news-manic-android-malware-device-relay-data-theft/)
- [New Android malware blurs the line between banking trojan and spyware (Cybernews)](https://cybernews.com/news/new-android-malware/)
- [Manic Android Malware (Cyber Security News)](https://cybersecuritynews.com/manic-android-malware/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3594