Manic Android Banking Trojan
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·54VzBC…dQcbSummary
Manic is an Android malware family first documented publicly by mobile threat intelligence firm ThreatFabric on August 20, 2026, combining banking-trojan fraud techniques with spyware and remote device-control capabilities. It monitors 169 Android package IDs — including cryptocurrency wallets and exchanges, banks, government identity services, and messaging apps — and introduces an offline Wi-Fi/Bluetooth mesh relay that lets infected devices exfiltrate stolen data through other infected phones even without their own internet connection. It is not a company or token but a criminal tool; this page documents its alleged capabilities and scope as reported by security researchers.
Connected Entities
2 entitiesTimeline(6 events)
February 2026
First infrastructure (a domain) associated with Manic is registered under a fabricated persona.
The Hacker NewsMay 2026
The first retained version of the Manic implant and its delivery wrapper are observed.
ThreatFabric13 July 2026
Signs emerge of a second Manic deployment after the original development environment was abandoned.
The Hacker NewsJuly 2026
An updated wrapper adds anti-analysis checks, in-memory DEX loading, and lock-secret ('autoEnterPin'/lock-screen) phishing capability; a new operator panel and API go live.
ThreatFabric20 August 2026
ThreatFabric publishes its detailed technical report introducing and naming Manic.
BleepingComputerAugust 2026
Coverage is updated with Google's statement that no apps containing the malware were found on Google Play, and that Google Play Protect defends against known versions.
BleepingComputerDecision Log
- slot 462181914 · hash CMCvRsc4TcU9JfRoWR1fiZrFiCq21CDXsDP3vVLpytBt
- slot 462181909 · hash J3iM1xevrH4Azkwuj62uNYASxFfxNMBujVFZ2nAizutg
- slot 448470725 · hash DncA7Q5eapjySPJdDgCW9tA5y4eH7C4qbRLwMiZLcHni
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 0 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/19/2026, 5:08:42 PM
last updated: 10/27/2026, 7:02:48 PM
4 viewsavoid.net — verified advice for a post-truth world