A newly discovered Android malware strain called “Manic” is actively targeting banks, government and identity services, messaging apps, crypto platforms, and military communication channels across Ukraine, Russia, Western and Central Europe, and the U.K. Rather than being pure spyware or banking trojan, Manic combines both: fraud capabilities, surveillance tools, location tracking, and device control. ThreatFabric, a security firm, has revealed that Manic can even siphon data from phones that are disconnected from the internet, by passing it through other infected devices nearby. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
Infection Methods & Targets
Manic spreads via phishing sites and dropper apps that masquerade as utility tools. The earliest signs date back to February 2026, when a fake identity was created to register its first domain. By late May 2026, the attackers had introduced their first “wrapper”—a malicious app disguise—and implant components. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html)) The campaign paused briefly during late June and mid-July, then resumed around July 13 with newer wrappers and implants featuring stronger defenses against detection and siphoning of screen lock secrets. By July 24–28, a command panel and API had gone live. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
APK filenames identified include “tech.intel.dialer.updater,” “org.honor.secure.helper,” “org.lenovo.storage.processor,” and “dev.huawei.media.helper,” with some acting as wrappers, others serving as the core implant. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html)) ThreatFabric found Manic monitors and targets over 169 specific apps: banking, P2P payments, BNPL services, cryptocurrency wallets and exchanges, eID and government apps, browsers, authenticators, email clients, and messaging platforms. Though many victims are in Ukraine, apps used in Russia, Central and Western Europe, and the U.K. also appear on the target list. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
Capabilities & Evasion
Manic abuses Android’s accessibility and notification permissions to intercept keystrokes, one-time passcodes, recovery phrases, and screen-lock passwords. It also mimics overlays to capture sensitive input without alerting users. The implant can record text, identify which app it came from, take screenshots, and monitor notifications. Remote surveillance extends to location tracking, file exfiltration, and even real-time device control through WebRTC sessions. Additional features include exporting contacts, SMS, call logs; disabling Google Play Protect; deleting files; sending SMS; and locking the screen. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
To avoid detection, Manic leverages anti-analysis checks. It deploys HTML lock-screen phishing overlays, uses fake UI update screens, and removes its icon from launchers. It also establishes persistence via Android background workers, scheduled alarms, and reliance on accessibility plus notification services. These components maintain communication with the command-and-control (C2) server, periodically sync data, and upload collected info. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
Offline Data Exfiltration Through Mesh Relays
One of Manic’s most alarming abilities is to exfiltrate data even when the infected device is offline. It stores stolen data locally in encrypted queues. Then, when in proximity of another compromised device that has internet access, it uses Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT to transfer the data onward to the C2 server. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html)) Multiple relay hops are possible—up to four by default—so data can move across several devices before reaching the attacker’s infrastructure. If no infected peer is nearby, the malware holds on to the data and retries later. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
ThreatFabric notes that from May through July 2026, Manic’s evolution—stronger evasion tactics, lock-screen phishing, enhanced implants—signals ongoing development. Its ability to adapt and expand its attack surface poses increasing risk. ([thehackernews.com](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html))
For defense, users should only install apps from trusted sources, scrutinize app permissions (especially accessibility and notification rights), disable unknown or untrusted apps that request excessive privileges, and enable security tools where available. Mobile security products should monitor for unusual overlay behaviors, inter-device communications (Bluetooth/Wi-Fi), and mesh-relay patterns.
Analytically, Manic’s emergence underscores a shifting paradigm in mobile malware. No longer confined to stealing money or spying from fully online devices, malware that can function covertly while offline and exfiltrate data via infected peers presents a formidable challenge for defenders. It raises serious questions about air-gapped or disconnected device security, supply in local environments of mixed compromised devices, and new detection vectors. Security teams must adjust not just to what phones do online, but also who is nearby.
