{"investigation":{"slug":"manic-android-banking-trojan","entity_name":"Manic Android Banking Trojan","trust_score":0,"severity_base":null,"score_modifier":-5,"confidence":0.92,"status":"published","content_type":"investigation","summary":"Manic is an Android malware family first documented publicly by mobile threat intelligence firm ThreatFabric on August 20, 2026, combining banking-trojan fraud techniques with spyware and remote device-control capabilities. It monitors 169 Android package IDs — including cryptocurrency wallets and exchanges, banks, government identity services, and messaging apps — and introduces an offline Wi-Fi/Bluetooth mesh relay that lets infected devices exfiltrate stolen data through other infected phones even without their own internet connection. It is not a company or token but a criminal tool; this page documents its alleged capabilities and scope as reported by security researchers.","sections":[{"content":"Manic was identified and named by the mobile threat intelligence team at ThreatFabric, which published a detailed technical report on August 20, 2026. ThreatFabric describes it as sitting \"at the intersection of Android banking malware and mobile spyware,\" combining financial fraud capabilities with broader surveillance and remote device-control features. Associated infrastructure was first registered in February 2026 under a fabricated persona, with active development following soon after. Multiple outlets, including The Hacker News, BleepingComputer, Security Affairs, Kaspersky, and eSecurityPlanet, covered the findings in the days following the report's publication.","heading":"Identification and Classification","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","name":"The Hacker News: Manic Android Malware Exfiltrates Data","type":"news_article","credibility":2},{"url":"https://securityaffairs.com/197570/malware/manic-the-android-malware-that-exfiltrates-data-even-when-the-phone-is-offline.html","name":"Security Affairs: Manic Android Malware","type":"news_article","credibility":2}],"severity":"high"},{"content":"According to ThreatFabric's research, Manic monitors 169 distinct Android package IDs, a target list that spans banks, payment and buy-now-pay-later services, government and electronic-identity (eID) applications, authenticator apps, messaging apps, browsers, email clients, and cryptocurrency wallets and exchanges. The malware's accessibility-based keylogger automatically classifies captured on-screen text into categories, one of which is described as \"strings of characters that look like crypto wallet seed phrases,\" alongside passwords, email logins, SMS one-time codes, and lock-screen entry codes. Reporting does not name the specific crypto wallet or exchange apps targeted; the claim rests on ThreatFabric's package-ID classification and has not been independently verified against the full target list.","heading":"Crypto Wallet and Exchange Targeting","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://www.esecurityplanet.com/threats/news-manic-android-malware-device-relay-data-theft/","name":"eSecurityPlanet: New Manic Android Malware Uses Offline Networks to Drain Bank Accounts","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2}],"severity":"critical"},{"content":"ThreatFabric's report describes a component it calls pinPadOverlay, which covers only the bounding area of a numeric keypad inside a targeted banking or financial app with a transparent overlay. It logs the coordinates of each tap and the nearby UI element, briefly suppresses touch interception, and then replays the tap through Android's Accessibility service so the legitimate app still receives and processes the input normally. Unlike traditional phishing overlays, Manic does not display a fake banking interface to the victim. Separately, ThreatFabric states Manic \"uses its Accessibility service as a UI keylogger,\" classifying captured text into categories (lock-screen input, recovery-phrase candidates, four-to-six-digit SMS codes, passwords, and email logins) and recording the source app, timestamp, and whether input came from autofill or manual entry. There is minor inconsistency across secondary coverage about whether PIN capture requires an overlay at all; this page follows ThreatFabric's primary technical description, which does describe a (invisible) overlay component.","heading":"Invisible Overlay Keystroke Capture and Accessibility-Service Replay","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://www.esecurityplanet.com/threats/news-manic-android-malware-device-relay-data-theft/","name":"eSecurityPlanet: New Manic Android Malware Uses Offline Networks to Drain Bank Accounts","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2}],"severity":"critical"},{"content":"After obtaining Accessibility and notification permissions, Manic can allegedly intercept SMS messages and app notifications (including two-factor authentication and one-time codes before the victim even enters them), exfiltrate files, contacts, call logs, installed-app lists, and location data, and establish WebRTC sessions that let operators view the screen live and interact with the device remotely via Accessibility privileges. ThreatFabric documented bot commands including remote_control, screenshot, get_logs, location, export_sms/calls/contacts/push/apps/file, send_sms, ussd, send_push, send_file, delete_file, force_lock, geo, disable_gp (apparently targeting Google Play Protect), get_more_rights, refresh, and reload_config; a reset_password command exists in the code but reportedly returns \"not supported.\" Black, fake, or \"update\" screens are used to mask on-device activity and permission prompts during remote sessions. A separate feature named autoEnterPin attempts to automatically enter a previously captured PIN or pattern at the Android lock screen, potentially giving operators access to a locked device. ThreatFabric describes \"lock-secret phishing\" as introduced in a July 2026 wrapper update.","heading":"Device Takeover, Remote Control, and Lock-Screen Secret Theft","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2}],"severity":"critical"},{"content":"ThreatFabric identifies as Manic's most distinctive feature its ability to exfiltrate stolen data even from a device with no internet connection of its own. When a device cannot reach its command-and-control server, Manic encrypts stolen data locally using AES-GCM and queues it, then searches for other nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or Bluetooth Low Energy (BLE) GATT, trying Wi-Fi Direct first and falling back to Bluetooth/BLE peers that have internet access. The malware supports multi-hop relay routing, with a default maximum of four hops, meaning stolen data can pass through a chain of infected phones before reaching the internet. If no relay route is available, data remains queued on-device and retries later. Multiple outlets reported that this means disconnecting an infected phone from the internet does not necessarily stop data theft, as long as another infected device is within radio range.","heading":"Offline Wi-Fi/Bluetooth Mesh Exfiltration","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://www.kaspersky.com/blog/manic-android-trojan/56323/","name":"Kaspersky: No internet? The Manic Trojan can still steal your data","type":"news_article","credibility":2},{"url":"https://www.esecurityplanet.com/threats/news-manic-android-malware-device-relay-data-theft/","name":"eSecurityPlanet: New Manic Android Malware Uses Offline Networks to Drain Bank Accounts","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2}],"severity":"high"},{"content":"Reporting consistently describes Ukraine as Manic's primary focus, targeting Ukrainian banks, government/eID services, and messaging apps. The target list, drawn from the 169 monitored package IDs, also reaches financial institutions and government/eID services in Russia and across Central and Western Europe (Poland, Czech Republic, Slovakia, Austria, Germany, France, Spain, the Netherlands, Estonia, and Lithuania) as well as the United Kingdom, plus global fintech and cryptocurrency services and military-focused messaging applications. The scale of actual infections has not been disclosed by ThreatFabric or any outlet reviewed.","heading":"Geographic Targeting and Scope","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","name":"The Hacker News: Manic Android Malware Exfiltrates Data","type":"news_article","credibility":2}],"severity":"medium"},{"content":"According to The Hacker News, citing ThreatFabric, Manic is distributed via phishing websites and dropper apps that impersonate utility software; the first observed wrapper used a fake booking-app lure. Reported APK package names associated with the campaign include tech.intel.dialer.updater and org.honor.secure.helper (wrapper) and org.lenovo.storage.processor and dev.huawei.media.helper (implant) — names designed to impersonate legitimate device-utility or manufacturer services. A Google spokesperson told reporters that, based on Google's current detection, no apps containing this malware were found on the Google Play Store, and that Google Play Protect, enabled by default on devices with Google Play services, protects users against known versions of the malware. This statement was reported on August 21-22, 2026, shortly after ThreatFabric's initial report.","heading":"Distribution and Google Play Store Status","sources":[{"url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","name":"The Hacker News: Manic Android Malware Exfiltrates Data","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2}],"severity":"medium"},{"content":"ThreatFabric traces Manic's infrastructure to a domain first registered in February 2026 under a fabricated persona, with active development occurring in the following months. An implant was first observed at the end of May 2026. Development on that initial build appears to have been abandoned between late June and mid-July 2026, and signs of a second deployment emerged around July 13, 2026, with a corresponding operator panel and API going live between July 24 and 28, 2026. This second-generation wrapper reportedly added stronger anti-analysis checks, in-memory DEX loading (to evade static detection), and new lock-secret phishing capability. ThreatFabric published its findings on August 20, 2026, and the report was updated on August 21-22, 2026, to include Google's statement that no Play Store apps carried the malware. Researchers characterized Manic as still under active development as of the July 2026 changes, suggesting the campaign was ongoing at time of reporting.","heading":"Development Timeline and Ongoing Evolution","sources":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","name":"The Hacker News: Manic Android Malware Exfiltrates Data","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-02","event":"First infrastructure (a domain) associated with Manic is registered under a fabricated persona.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html"},{"date":"2026-05","event":"The first retained version of the Manic implant and its delivery wrapper are observed.","source":"ThreatFabric","source_url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware"},{"date":"2026-07-13","event":"Signs emerge of a second Manic deployment after the original development environment was abandoned.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","date_evidence":"Signs of a second deployment emerged around July 13, 2026"},{"date":"2026-07","event":"An updated wrapper adds anti-analysis checks, in-memory DEX loading, and lock-secret ('autoEnterPin'/lock-screen) phishing capability; a new operator panel and API go live.","source":"ThreatFabric","source_url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware"},{"date":"2026-08-20","event":"ThreatFabric publishes its detailed technical report introducing and naming Manic.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","date_evidence":"ThreatFabric publishes its report on August 20, 2026"},{"date":"2026-08","event":"Coverage is updated with Google's statement that no apps containing the malware were found on Google Play, and that Google Play Protect defends against known versions.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","date_evidence":"update dated August 22","date_original":"2026-08-22"}],"sources_used":[{"url":"https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware","name":"ThreatFabric: Manic — a blend between banking malware and spyware","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html","name":"The Hacker News: Manic Android Malware Exfiltrates Data","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/","name":"BleepingComputer: New Manic Android malware can exfiltrate data through nearby devices","type":"news_article","credibility":2},{"url":"https://www.esecurityplanet.com/threats/news-manic-android-malware-device-relay-data-theft/","name":"eSecurityPlanet: New Manic Android Malware Uses Offline Networks to Drain Bank Accounts","type":"news_article","credibility":2},{"url":"https://securityaffairs.com/197570/malware/manic-the-android-malware-that-exfiltrates-data-even-when-the-phone-is-offline.html","name":"Security Affairs: Manic Android Malware","type":"news_article","credibility":2},{"url":"https://www.kaspersky.com/blog/manic-android-trojan/56323/","name":"Kaspersky: No internet? The Manic Trojan can still steal your data","type":"news_article","credibility":2},{"url":"https://cybernews.com/news/new-android-malware/","name":"Cybernews: New Android malware blurs the line between banking trojan and spyware","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-19T17:08:42.578865+00:00","updated_at":"2026-10-27T19:02:47.986+00:00"},"source_quality":{"total":7,"tier1":0,"tier2":0,"tier3":0,"unrated":7},"follower_count":null,"content_updated_at":"2026-10-27T19:02:48.550Z","last_fact_checked_at":"2026-10-27T19:02:48.280Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}