Fact-check findings
What an automated fact-checker found when it re-read Manic Android Banking Trojan against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Device Takeover, Remote Control, and Lock-Screen Secret Theft
“a reset_password command exists in the code but reportedly returns "not supported."”
reviewerreset_password command exists but returns 'not supported'Command existence confirmed; the 'not supported' detail was not verified.
confirmed
8 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“first documented publicly by mobile threat intelligence firm ThreatFabric on August 20, 2026”
reviewerThreatFabric first documented Manic publicly on August 20, 2026Date matches primary and secondary sources. - #2[confirmed][no action needed]in the summary
“It monitors 169 Android package IDs”
reviewerManic monitors 169 Android package IDsConfirmed. - #3[confirmed][no action needed]in section: Offline Wi-Fi/Bluetooth Mesh Exfiltration
“The malware supports multi-hop relay routing, with a default maximum of four hops”
reviewerOffline relay with default maximum of four hops over Wi-Fi Direct, Bluetooth RFCOMM, BLE GATTConfirmed. - #4[confirmed][no action needed]in section: Invisible Overlay Keystroke Capture and Accessibility-Service Replay
“Unlike traditional phishing overlays, Manic does not display a fake banking interface to the victim.”
reviewerpinPadOverlay covers numeric keypad, replays taps via Accessibility, no fake interfaceMatches primary source. - #5[confirmed][no action needed]in section: Distribution and Google Play Store Status
“signs of a second deployment emerged around July 13, 2026, with a corresponding operator panel and API going live between July 24 and 28, 2026”
reviewerSecond deployment around July 13, 2026 and panel/API live July 24-28Dates come from The Hacker News, which the page cites. The ThreatFabric page as fetched did not show them, so the page's attribution of this sentence to ThreatFabric is slightly loose. - #6[confirmed][no action needed]in section: Geographic Targeting and Scope
“tech.intel.dialer.updater and org.honor.secure.helper (wrapper) and org.lenovo.storage.processor and dev.huawei.media.helper (implant)”
reviewerPackage names and Google statementConfirmed. - #8[confirmed][no action needed]in section: Geographic Targeting and Scope
“Reporting consistently describes Ukraine as Manic's primary focus”
reviewerUkraine primary focus plus listed European countries, Russia and UKConfirmed. - #9[confirmed][no action needed]in section: Crypto Wallet and Exchange Targeting
“Reporting does not name the specific crypto wallet or exchange apps targeted”
reviewerReporting does not name specific crypto wallet or exchange appsPage's own hedge is accurate.