Blend between Banking Malware & Spyware

Manic is an Android malware family active since February 2026 that blends banking malware and mobile spyware functionalities. It targets a broad range of financial and government-related applications across Ukraine, Russia, Europe, and globally in fintech and cryptocurrency sectors. The malware achieves device takeover through sophisticated surveillance and remote control features. It employs advanced PIN stealing by leveraging Accessibility services as a UI keylogger, capturing sensitive inputs such as lock-screen PINs, recovery phrases, and authentication codes without relying on traditional overlay attacks. A notable feature is its Wi-Fi mesh egress technique, which enables compromised devices to relay stolen data via Wi-Fi Direct, Bluetooth, or BLE through other infected devices when direct command and control (C2) communication is not possible. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messaging apps.

Manic enables extensive device takeover and surveillance, allowing attackers to capture sensitive authentication data such as PINs, recovery phrases, and authentication codes. This facilitates unauthorized access to banking, government, messaging, fintech, and cryptocurrency services. The Wi-Fi mesh egress technique increases the resilience of data exfiltration by enabling stolen data to be relayed through other infected devices, complicating detection and mitigation efforts. The malware's broad targeting of 169 applications across multiple countries increases the potential impact on financial and governmental sectors.

No official patch or remediation guidance is currently available. As this is Android malware leveraging Accessibility services and Wi-Fi mesh relay techniques, mitigation should focus on restricting app permissions, especially Accessibility service access, and monitoring for unusual device behavior. Users should avoid installing untrusted applications and keep their devices updated with the latest security patches from the vendor. Network monitoring for unusual Bluetooth, BLE, or Wi-Fi Direct activity may help detect lateral data relay attempts. Check vendor advisories and security community updates for any emerging detection or remediation tools.