Manic The Android Malware That Exfiltrates Data Even When the Phone Is Offline
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
Source: Securityaffairs
Published on: August 20, 2026
🚨 Overview:
Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline. ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development as of July.
Key Features of Manic
- Targeting: Strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications. It also extends to Russian and European financial institutions, global fintech, and cryptocurrency services, as well as military-focused communications.
- Monitoring: Manic monitors 169 different Android apps, including banking and payment apps across several European countries, government and eID services, crypto exchanges and wallets, 2FA tools, messaging apps, browsers, and email clients.
Installation and Functionality
Once installed, Manic requests Accessibility and notification access, then uses the Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.
Unique Techniques
- PIN Theft: When Manic detects a numeric keypad in a targeted app, it places an invisible layer over the keys and records each tap. It briefly passes the tap to the real keypad using Android’s Accessibility features, allowing the banking app to work normally while capturing the PIN.
- Remote Control: Manic gives attackers remote control of the device through WebRTC, allowing them to view the screen and interact with it using Android’s Accessibility features.
Offline Relay Mechanism
Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly. Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure. It searches for nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four relay hops.
Conclusion
Manic is an evolving Android fraud platform designed for Device Takeover (DTO), combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine. A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable.
For defenders, monitoring for unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections from phones that aren’t actively transferring files are the most practical detection starting points.