Manic: The Android Malware Creating a Mesh Network to Steal Data Offline

An Android Threat Still Under Development

A new Android malware strain called Manic has been active since at least February 2026. It combines banking trojan, spyware, and Device Takeover (DTO) capabilities. ThreatFabric published its analysis on August 20, 2026; a build observed in July 2026 indicated that development was still ongoing.

The threat primarily targets Ukraine, focusing on banks, government services, digital identity applications, and communication tools associated with the military sector. The campaign also affects Russian and European financial institutions, fintech services, and global cryptocurrency platforms.

Manic monitors 169 Android applications, including banking and payment apps, crypto exchanges and wallets, eID services, two-factor authentication tools, messaging apps, browsers, and email clients.

This broad coverage allows operators to combine financial data, communications, location information, files, and credentials from the same device. The result is more than financial theft: the phone can become a source of personal, operational, and potentially strategic intelligence.

Turning Accessibility Permissions into Surveillance

After installation, Manic requests access to Android Accessibility services and notifications. Accessibility is used to monitor the interface and intercept what the user types or views.

The malware does not necessarily record every character indiscriminately. Instead, it classifies collected content, distinguishing lock-screen input, passwords, long messages, ordinary text, four- to six-digit SMS codes, and potential wallet recovery phrases.

Each event may include:

• application name and package;
• intercepted text;
• timestamp;
• whether Autofill or manual entry was used;
• whether the app appears on the operator-configured target list.

Notification access expands visibility into one-time codes, messages, and alerts generated by applications. Together, Accessibility and notification permissions can compromise systems that use a second authentication factor.

The monitored list also includes messaging apps, browsers, and email clients. Attackers can therefore connect banking credentials with conversations, email accounts, browsing data, and digital identity services on the same phone.

Banking PINs, Fake Screens, and Remote Control

Manic captures banking PINs using a technique that differs from a standard fraudulent overlay. When it detects a numeric keypad in a targeted app, it places an invisible layer over the keys and records the user’s input.

After briefly processing the input, the malware forwards the taps to the legitimate keypad through Accessibility functions. The banking app can therefore continue operating normally, without the user necessarily noticing anything unusual.

The autoEnterPin feature can attempt to enter a previously stored PIN or sequence into the Android lock screen. The operating sequence is straightforward:

1. Manic captures the PIN while the victim uses a banking app;
2. it stores the information;
3. it later attempts to use it to unlock the device.

The latest observed build also includes so-called lock-secret phishing. The malware displays a fake screen before the genuine lock screen and tricks the victim into entering a PIN or pattern.

Once the necessary permissions have been obtained, operators can control the device through WebRTC, viewing the screen and interacting with the interface via Accessibility. To conceal their activity, Manic can display black screens, fake updates, disguised permission prompts, or custom-built screens.

The malware can also remove its icon from the Android launcher. It therefore disappears from the normal app list while remaining launchable through a wrapper or deep link.

Exfiltration Continues Even Without Internet Access

Manic’s most unusual feature is its store-and-forward transfer mechanism. Files and command results are encrypted with AES-GCM and placed in a local queue.

If the phone cannot connect directly to the command-and-control server, the malware searches for other nearby infected devices. These devices can act as relays and later forward the data to the attackers’ infrastructure.

Device-to-device communication may use:

• Wi‑Fi Direct;
• Bluetooth RFCOMM;
• BLE GATT.

The chain can span four hops. In practice, information can pass through several compromised phones before reaching the remote server.

This behavior creates an opportunistic mesh network built from victims’ devices. Disabling Internet access on a single phone therefore does not guarantee that exfiltration will stop: another infected device within radio range can receive the data and transmit it on behalf of the first.

The model is particularly relevant in environments where connectivity is limited or deliberately disrupted. The device can continue collecting information, storing it locally, and transferring it when it encounters an available relay.

Technical Evolution and Defensive Guidance

The infrastructure associated with Manic appears to have been registered starting in February 2026. Development and production services reportedly emerged between late March and April 2026.

The build analyzed in July 2026 included more advanced anti-analysis checks and loaded DEX files directly into memory. This technique can complicate static analysis and reduce artifacts left on the device’s filesystem.

No specific vulnerable Android versions or single infection vector have been identified. The risk affects users who install Manic and the accounts used on the device: banks, wallets, email, eID services, 2FA applications, and communication tools may all be compromised together.

Behavioral indicators to investigate include:

• unexpected grants of Accessibility permissions;
• unusual requests for PINs, patterns, or other unlock credentials;
• apps that disappear from the launcher but remain launchable;
• Bluetooth or Wi‑Fi Direct connections not explained by file transfers;
• suspicious, correlated activity involving banking apps, wallets, 2FA apps, and eID services;
• black screens, fake updates, or permission prompts appearing at unusual times.

Simply blocking Internet access is not enough. Defense should include reviewing Accessibility permissions, monitoring local radio communications, and analyzing apps authorized to read notifications or interact with the interface.

Anyone who suspects a compromise should revoke abnormal permissions, isolate the device from networks, and review accounts from a trusted device. Banking transactions, active sessions, wallets, and recovery codes should also be checked. Affected versions and a dedicated public removal procedure are not currently known.