Manic is an Android malware family combining spyware, banking fraud, and remote control features. It targets at least 169 apps related to banking, government identification, payments, crypto wallets, messaging, and two-factor authentication, focusing primarily on Ukrainian users but also affecting Central and Western Europe and Russia. The malware uses Android Accessibility services to overlay numeric keypads, capturing user taps and reproducing them to avoid detection. It collects lock screen PINs/passwords, intercepts notifications and SMS, gathers files and location data, and enables remote control via WebRTC. Manic classifies captured text by type for easier exploitation. Its novel data exfiltration fallback uses encrypted transfers over Wi-Fi Direct or Bluetooth through nearby infected devices, supporting multi-hop relays up to four hops, allowing offline devices to still leak data if in proximity to infected peers. The infection vector is unknown, but recent updates include stronger anti-analysis and in-memory DEX loading. Mitigation includes avoiding unofficial APKs and denying Accessibility permissions to untrusted apps.

Manic malware can steal sensitive user data including lock screen credentials, SMS codes, passwords, and other classified text inputs. It can intercept notifications and SMS messages, collect files and location data, and provide remote control to attackers. Its ability to exfiltrate data via nearby infected devices over Wi-Fi Direct or Bluetooth enables data leakage even when the device is offline or disconnected from the internet. This multi-hop relay capability increases the difficulty of containment and detection. The malware targets critical financial, government, and authentication applications, potentially enabling financial fraud, identity theft, and unauthorized account access.

There is no vendor patch or official fix available as this is malware rather than a software vulnerability. Users should avoid downloading APKs from unofficial or obscure sources. Accessibility permissions should be granted only to trusted applications, as Manic abuses these permissions to capture sensitive input. Regularly running Google Play Protect scans can help detect and remove known malware variants. Network-level controls to monitor and restrict Wi-Fi Direct and Bluetooth connections may help limit the malware's fallback data exfiltration mechanism. Users and organizations should maintain vigilance for suspicious app behavior and unauthorized permissions.