A new Android malware, dubbed Manic, has been identified by ThreatFabric's Mobile Threat Intelligence team, active since at least February 2026. The malware, which is still under development as of July, combines features of banking malware and mobile spyware, enabling financial fraud, surveillance, and device control.
Manic's targeting is heavily focused on Ukraine, including Ukrainian banks, government and identity services, and messaging applications. It also extends to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. The malware monitors 169 different Android applications, encompassing banking and payment apps across several European countries, government and eID services, crypto exchanges and wallets, two-factor authentication tools, messaging apps, browsers, and email clients. This broad targeting allows attackers to track a victim’s finances, communications, location, and files from a single compromised device.
Initial infrastructure registrations for Manic were observed in February 2026, with development and production services appearing in late March and April. By July, an updated build incorporated enhanced anti-analysis checks, in-memory DEX loading, and a "lock-secret phishing" technique. This technique presents a fake prompt before the legitimate lock screen to extract the device's PIN or pattern.
Upon installation, Manic requests Accessibility and notification access. It then leverages the Accessibility service as a UI keylogger, classifying captured input before logging it. This includes lock-screen input, recovery phrase candidates, four-to-six-digit SMS codes, passwords, long messages, email logins, and ordinary text. Each log record contains the app name and package, the captured text, a timestamp, whether the input was autofilled or manually entered, and whether the app is on Manic's target list.
The malware's PIN theft method differs from typical banking overlays. When a numeric keypad is detected in a targeted application, Manic places an invisible layer over the keys, recording each tap. It then briefly passes the tap to the real keypad via Android’s Accessibility features, allowing the banking app to function normally while the PIN is captured. An "autoEnterPin" function can also attempt to enter a stored PIN or pattern on the Android lock screen, providing attackers with the ability to unlock the device remotely using a previously captured PIN.
A particularly distinctive feature of Manic is its offline relay mechanism. It uses a store-and-forward system to exfiltrate data even when the infected device lacks a direct connection to the command-and-control (C2) server. Collected files and command results are encrypted with AES-GCM and stored in a local queue. The malware then searches for other nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, using them as relays to reach the C2 infrastructure. This system supports chains of up to four relay hops, meaning that cutting an infected phone off from the internet does not prevent data exfiltration as long as another infected device is within radio range.
Manic also grants attackers remote control of the device through WebRTC, enabling them to view the screen and interact with it using Android’s Accessibility features. It can conceal its activities with black screens, fake screens, or fake update messages, and can also hide permission requests. The July version further enhances stealth by removing itself from the device’s app launcher, keeping it out of the normal app list and allowing activation through its wrapper or a deep link.
The combination of credential theft, live screen monitoring, authentication interception, device takeover, and an offline exfiltration path makes Manic a comprehensive threat. For defenders, monitoring for unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections from phones not actively transferring files are practical starting points for detection. Manic is described as an evolving Android fraud platform designed for Device Takeover (DTO).
