New Manic Android Malware Targets 169 Apps, Steals PINs and Exfiltrates Data via Wi-Fi Mesh

A newly discovered Android malware family called Manic, which combines banking fraud functions with advanced spyware and remote device control capabilities.

The operation’s active infrastructure dates back to February 2026, with early wrappers and implants emerging in late May.

Manic has rapidly evolved through July, incorporating stronger anti-analysis protections, in-memory DEX loading, lock-screen phishing, and an expanded command-and-control infrastructure.

New Manic Android Malware

Manic targets 169 specific Android package IDs across various sectors, including banking, payment, cryptocurrency, identity, messaging, browser, and email applications.

Its primary focus is on Ukraine, specifically targeting local financial institutions, government services, electronic identity platforms, and communication applications.

However, it also includes banks and services from Russia, Poland, the Czech Republic, Slovakia, Austria, Germany, France, Spain, the Netherlands, Estonia, Lithuania, and the United Kingdom.

Additionally, it targets global cryptocurrency exchanges, wallets, fintech platforms, authentication applications, and military-focused messaging services.

The targeting profile indicates that Manic is designed for both financial fraud and surveillance. Infected devices can provide operators with insights into financial sessions, SMS messages, notifications, files, location data, browser activity, and communications.

Once installed, the malware attempts to obtain Accessibility Service and notification-listener permissions, enabling a broad device-takeover workflow.

These privileges allow Manic to automate user interface actions, collect data displayed on the screen, intercept typed information, and interact with applications remotely.

A significant feature of Manic is its Accessibility-based UI keylogger. The malware categorizes captured input to identify lock-screen credentials, recovery phrases, four- to six-digit SMS codes, passwords, long messages, email logins, and other text.

Each captured record can include the application name, package ID, timestamp, input source, and whether the app is among Manic’s targets. This allows threat actors to prioritize credentials and authentication materials related to banking and cryptocurrency applications.

Manic also introduces an advanced PIN-stealing capability that bypasses traditional phishing overlays. Its pinPadOverlay function identifies numeric keypads within targeted banking applications and places an overlay only over the keypad area.

When a victim taps a digit, the malware records the position and nearby interface element, briefly turns off touch interception, and then replays the action through Accessibility. As a result, the legitimate banking application receives the original input, allowing the victim’s session to continue normally while the PIN is captured.

The autoEnterPin capability targets Android lock screens by attempting to enter previously stored credentials or patterns. Combined with fake black, update, or permission screens, this feature helps operators conceal fraudulent activity during remote-control sessions.

Manic supports WebRTC-based remote access, enabling live screen monitoring, accessibility-driven interaction, screenshots, and potentially front-camera sessions.

Most notably, Manic employs a store-and-forward Wi-Fi mesh mechanism for data exfiltration. Stolen data is encrypted with AES-GCM and placed in a local queue.

When direct access to command-and-control infrastructure is unavailable, Manic searches for nearby infected devices using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT.

ThreatFabric’s Mobile Threat Intelligence team has identified that compromised devices with internet access can relay encrypted packages back to the command-and-control server, with up to four relay hops configured by default.

This capability means that isolating a compromised device from the internet may not fully prevent data theft if another infected device is nearby.

IOC Table Data

Role	SHA-256	Package Name
July wrapper	80be0942d0e20b5006e240434f42512c8b3cd0d54eee858a25663c1a4224a576	tech.intel.dialer.updater
July dropped implant	feea425cde1223fe7afdd7a1ea631678ec6282f6cc20c3d3c0fb97cdbcf65b9b	org.lenovo.storage.processor
Primary implant	e7abc375f24d0dd2419e0bce4686c7301b3ee82ae38906c67d3481580f6c648e	tech.apple.dialer.scheduler
Implant sibling	7c12f1237090e32c18583f66f1a9e44b029ad7c1e61179e1d524fb3093abd59a	io.motorola.secure.executor
May wrapper	2884108b35eba7b8099087405653c1b23c3839f0d5058c4d61341fc31cfc6040	org.honor.secure.helper
May implant	2fb5b01ea5a483d60b659e85327a53c6661bdd630d4afd93dc5fe0941d3ccbbe	dev.huawei.media.helper

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC