"Manic first attempts to use an established Wi‑Fi Direct peer, then queries Bluetooth and BLE peers to determine whether they have internet connectivity." That chain of steps, ThreatFabric warns, is part of an unusual fallback that allows the new Android malware family Manic to exfiltrate stolen data even when an infected device has no direct connection to its command-and-control servers.
How Manic captures credentials and in‑app secrets
ThreatFabric's analysis shows Manic combines spyware, banking fraud, and remote‑control capabilities into a single Android payload active since at least February. The malware gains Accessibility and notification access permissions and then uses those privileges in two complementary ways: transparent overlays on numeric keypads to capture users' taps, and Android Accessibility APIs to reproduce those taps so legitimate apps continue to appear to function normally.
ThreatFabric describes the Accessibility service as acting "as a UI keylogger." The malware classifies captured text before saving it — distinguishing lock‑screen input, recovery‑phrase candidates, four‑ to six‑digit SMS codes, passwords, long messages, email logins, and ordinary text — a design choice that makes the stolen material immediately more actionable for operators.
With the requested permissions, Manic can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and give operators remote control through WebRTC sessions.
Data exfiltration through nearby infected devices — Wi‑Fi Direct, Bluetooth, and multi‑hop relays
The distinctive element in Manic is a fallback exfiltration method that moves data via nearby compromised devices when the infected handset cannot reach its C2 infrastructure. ThreatFabric reports that captured data is encrypted and transferred over Wi‑Fi Direct or Bluetooth connections to other infected devices.
The malware's logic first attempts an established Wi‑Fi Direct peer, then queries Bluetooth and BLE peers to determine if those peers have internet connectivity. If necessary, Manic can forward data across multiple hops; newly queued items are configured for a maximum of four relay hops by default. That design enables exfiltration even from offline devices so long as another infected device is within Wi‑Fi or Bluetooth range.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTargets and geographic focus
Manic is configured to target at least 169 applications spanning banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA categories. ThreatFabric says the malware is active across Central and Western Europe, including the U.K., and Russia, but that its primary focus appears to be banking and government/eID applications in Ukraine, alongside global fintech and cryptocurrency services.
Delivery, evolution, and technical hardening
The precise infection vector remains unknown. ThreatFabric observed a wrapper used in late May to deliver the main payload, and an expansion of the attack infrastructure in subsequent months. In July a new wrapper was seen that added stronger anti‑analysis checks and in‑memory DEX loading, and the operators rolled out a new panel and API — signs of active development and operational scaling.
What this means for Android users, security teams, and financial services
- Android users: Avoid downloading APKs from obscure sources and unofficial portals, deny Accessibility permissions unless required by a trusted application, and run Play Protect scans regularly to detect and remove known malware.
- Security teams and incident responders: Be alert for unusual device‑to‑device traffic over Wi‑Fi Direct or Bluetooth and for indicators tied to in‑memory DEX loading and strengthened anti‑analysis wrappers; consider that compromised devices may be used as relays even when individual devices appear offline.
- Banks, government eID providers, and fintech firms: Recognize that credential capture and classified text exfiltration can bypass surface prevention if collected on device; mitigate risk through multi‑layered controls and by assuming that mobile credentials may be compromised once attackers obtain Accessibility or notification permissions.
ThreatFabric's report paints Manic as a multi‑capability, actively developed Android threat with an uncommon network‑level fallback: encrypted exfiltration via nearby infected devices and configurable multi‑hop relays. The report also notes a practical gap between initial prevention and post‑compromise activity. As ThreatFabric traces the malware's technical progress, one clear operational question remains unanswered in the findings published so far: how the earliest victims receive the initial wrapped payload that begins the infection chain.
