Security researchers at ThreatFabric have identified a new Android malware family called Manic that has been active since at least February 2026, primarily targeting users in Ukraine along with victims across Central and Western Europe, the U.K., and Russia. The malware blends spyware, banking fraud, and remote access trojan capabilities, and targets at least 169 apps spanning banking, government/eID, payment, cryptocurrency wallet, messaging, and authenticator/2FA services.

Overlay-based keylogging

Manic abuses Android’s Accessibility service to place transparent overlays on the numeric keypads of legitimate apps. It captures the victim’s taps and replays them through Accessibility so the targeted app continues functioning normally, all while quietly recording input. ThreatFabric notes the malware classifies captured text on the fly, distinguishing lock-screen PINs, recovery-phrase candidates, four- to six-digit SMS codes, passwords, email logins, and general messages before storing them.

Once it secures Accessibility and notification access, Manic can capture device lock credentials, intercept SMS and notifications, harvest files and location data, monitor the screen, and hand operators live remote control via WebRTC sessions.

Exfiltration through nearby devices

The malware’s most unusual feature is a fallback exfiltration path for when an infected device cannot reach its command-and-control server. In that scenario, Manic encrypts the stolen data and relays it through other nearby compromised devices using Wi-Fi Direct or Bluetooth/BLE connections. It first checks for an established Wi-Fi Direct peer, then queries Bluetooth peers for internet connectivity, and can even chain data across multiple hops, up to four by default, until it reaches a device that can reach the internet. This means data can leave a completely offline phone as long as another infected device is within wireless range.

Evolving infrastructure

ThreatFabric first observed a delivery wrapper dropping the Manic payload in late May, with infrastructure expanding in subsequent months. By July, the group had rolled out an updated wrapper featuring stronger anti-analysis checks and in-memory DEX loading, alongside a new control panel and API. The exact initial infection vector remains unconfirmed.

Recommendations

  • Avoid installing APKs from unofficial sources or third-party app stores
  • Deny Accessibility permissions to apps unless explicitly required and trusted
  • Run regular Google Play Protect scans to detect known malware