Manic Android malware can move stolen data through nearby phones using Wi‑Fi mesh, letting attackers sidestep direct control. That odd capability means a victim’s phone can become a relay for its own data, turning a single infection into a covert network.
Key Takeaways
- Manic is a new Android banking trojan that also functions as spyware.
- It targets Ukrainian banks, government services, and messaging apps, but also reaches Russia, Europe, and global fintech.
- The malware can log keystrokes, display phishing screens, and remotely control the phone for fraud.
- Its Wi‑Fi mesh relay lets data hop between infected devices when direct C2 is blocked.
- ThreatFabric traced activity back to February 2026, with rapid evolution by July.
Manic Android Malware: A New Threat
ThreatFabric’s Mobile Threat Intelligence team first spotted Manic in February 2026. The name itself hints at a hybrid: it’s a banking trojan that also spies. The malware’s code base merges financial‑fraud routines with surveillance functions, so operators can both steal money and monitor victims’ communications. That dual purpose raises the stakes for defenders, who must guard against both banking attacks and privacy breaches.
Targeting Scope and Impact
Manic’s target list is impressive. ThreatFabric reports it monitors 169 package IDs, covering banks, payment services, cryptocurrency wallets, messaging apps, government identity services, browsers, and email clients. Most of those are Ukrainian, but the list also includes Russian, Central and Western European, and UK apps, plus global fintech and crypto services. The sheer breadth shows that operators want to hit any financial or communication channel that can be monetized.
Advanced Device Takeover Capabilities
Once a phone is infected, Manic takes over through a layered approach. First, it requests Accessibility and notification permissions. With those, it can capture lock secrets and overlay fake screens. Next, it acts as a UI keylogger, intercepting keypad taps inside banking and crypto apps to grab passwords, one‑time codes, and recovery phrases. The malware also harvests notifications, tracks location, and can even take screenshots. That gives operators a 360‑degree view of a victim’s financial life and broader communications.
Keylogger and Phishing Screens
The Accessibility service is the heart of the keylogger. When a user types a PIN, the malware records the input before it reaches the legitimate app. It then shows a fake screen that looks just like the bank’s login page, so the user thinks they’re still interacting with the real app. The malware can also display phishing screens for other services, expanding the attack surface.
Wi‑Fi Mesh Relay Explained
What sets Manic apart is its offline mesh relay. ThreatFabric notes that the malware can move collected data through nearby infected phones over Wi‑Fi Direct or Bluetooth when direct command‑and‑control (C2) access is unavailable. The infected phone becomes a node in a covert network, forwarding data to another device that can reach the internet. This technique keeps the operators’ traffic hidden, reduces latency, and bypasses network restrictions.
Because the relay uses peer‑to‑peer connections, defenders can’t block a single IP. Instead, they need to detect the malware’s presence on any device in a local area. That’s a hard problem, especially when the malware can hide behind legitimate apps and use encryption.
Defensive Measures and Detection
Security teams should watch for several indicators. First, unusual Accessibility permissions granted to a new app. Second, a sudden spike in device‑to‑device Wi‑Fi Direct or Bluetooth traffic. Third, a pattern of keystroke logging and notification monitoring in a single process. Finally, the presence of Android apps that target 169 known financial and messaging package IDs.
ThreatFabric recommends scanning for the exact binary hash and monitoring the device for the characteristic Wi‑Fi mesh behavior. They also advise keeping Android OS and all apps up to date, as the malware exploits known vulnerabilities in older versions.
What This Means For You
For developers building banking or fintech apps, the takeaway is clear: don’t rely solely on platform permissions. Add runtime checks that verify the integrity of the Accessibility service and monitor for unauthorized keylogging. Also consider sandboxing sensitive flows and using secure element hardware for PIN entry. If you’re a security engineer, treat Wi‑Fi Direct traffic as a potential threat vector and log any unusual peer‑to‑peer connections.
For founders of mobile app companies, the lesson is that your users’ devices can become part of a larger attack network. Regularly audit third‑party libraries, keep your build chain clean, and educate users about the risks of installing apps from untrusted sources. The Manic example shows how quickly a new threat can spread and evolve.
Historical Context
Android banking trojans have been around for years. Early variants focused on stealing credentials through overlay attacks and then exfiltrating them over a single C2 channel. Over time, attackers added modules for SMS interception and remote command execution. The evolution toward a mesh‑based relay marks a shift from a linear infection chain to a more resilient, decentralized architecture.
Wi‑Fi Direct and Bluetooth have long been part of Android’s connectivity suite. Malware that abuses these channels isn’t new, but the systematic use of a mesh to bypass C2 restrictions is a notable refinement. By embedding the relay logic directly into the trojan, the authors removed the need for a separate payload that merely scans for nearby devices.
February 2026 is the first point where ThreatFabric observed Manic in the wild. Within a few months, the codebase expanded to include the mesh capability. That rapid iteration mirrors the broader trend of threat actors iterating quickly once a novel technique proves effective.
Real‑World Scenarios
Scenario 1 – A fintech startup’s beta test. A small team releases a prototype wallet app to a closed group of testers. One tester downloads an unrelated app that contains Manic. The infected phone logs the tester’s wallet PIN, then forwards the data through a mesh of nearby phones to a server in a different country. The startup sees unexplained withdrawals from user accounts and must scramble to patch both the UI flow and the device‑level checks.
Scenario 2 – Enterprise mobile device management (MDM). A corporation enforces strict network policies, blocking unknown outbound traffic. An employee’s device is compromised, but the malware cannot reach its C2 directly because of the firewall. Using Wi‑Fi mesh, the device hops data to a colleague’s phone that has a less restrictive connection, allowing the exfiltration to continue unnoticed. The security team’s logs show only normal internal Wi‑Fi traffic, making detection difficult.
Scenario 3 – Government service phishing. A citizen uses a government identity app that Manic targets. The trojan captures the authentication token and then displays a convincing phishing screen for a popular messaging app. The victim, thinking they need to re‑verify, enters their credentials, which are logged and later relayed via the mesh to a command server. The breach leads to identity theft and fraudulent transactions across multiple services.
Each scenario highlights a different vector: third‑party app infection, network restrictions, and credential harvesting. Developers and security leaders can use these examples to map out where their own defenses might be thin.
Competitive Landscape
Manic is not the only malware that blends financial theft with surveillance. Other families have added spying modules to broaden revenue streams. The common thread is a focus on high‑value targets—banks, payment processors, and messaging platforms. What differentiates Manic is the explicit use of a Wi‑Fi mesh to keep data flowing even when traditional channels are cut.
Defenders observing the landscape notice a pattern: as network monitoring improves, attackers look for ways to hide traffic inside legitimate peer‑to‑peer protocols. The mesh approach uses the fact that Wi‑Fi Direct connections are typically allowed on most devices, and they often bypass corporate firewalls. This makes the technique attractive for any threat actor seeking persistence and stealth.
Key Questions Remaining
How will Android’s future permission model affect the feasibility of the Accessibility‑based keylogger? Will tighter controls on Wi‑Fi Direct reduce the mesh’s effectiveness, or will attackers simply shift to other peer‑to‑peer technologies? Can endpoint detection and response (EDR) tools evolve fast enough to spot the subtle traffic spikes that indicate a mesh is active?
Answers will shape the next wave of defenses. Researchers are already probing ways to fingerprint mesh traffic without breaking encryption. If those methods become mainstream, the cat‑and‑mouse game could tilt back toward defenders.
What Happens Next
ThreatFabric expects more variants to appear that refine the mesh logic. The core idea—turning each infected phone into a relay—is likely to be reused in other platforms, such as iOS, if similar peer‑to‑peer APIs are exploited. Organizations should therefore broaden their monitoring to include cross‑device patterns, not just single‑device anomalies.
In the short term, security teams will focus on rule sets that flag sudden bursts of Wi‑Fi Direct connections, especially when paired with newly granted Accessibility rights. Longer term, the industry may push for OS‑level mitigations that require explicit user consent for any device‑to‑device data forwarding.
Further Reading
For a deeper dive into Manic’s code and behavior, check the original report on SecurityWeek: original report. The ThreatFabric blog post also breaks down the Wi‑Fi mesh technique in detail.
Sources: SecurityWeek, ThreatFabric, Acronis
Primary sources: threatfabric.com (Primary source linked by the report), acronis.com (Primary source linked by the report).
