This Android malware steals banking credentials even without an internet connection | Kaspersky official blog

Manic is an Android Trojan combining banking malware, spyware, and remote access capabilities. It abuses Android Accessibility services to monitor screen content, interact with apps, and capture user input stealthily. Its novel technique involves generating a transparent overlay keyboard that records keystrokes and replays them on legitimate app keyboards, enabling credential theft without fake login screens. Manic targets banking, government, crypto, and two-factor authentication apps, focusing on users in Austria, Czech Republic, Estonia, France, Germany, Lithuania, Netherlands, Poland, Russia, Slovakia, Spain, Ukraine, and the UK. Distribution methods are not fully confirmed but exclude Google Play Store. The malware can send stolen data even when the device lacks internet connectivity, indicating advanced data exfiltration methods. It also resists uninstallation and disables security features by leveraging Accessibility permissions. The earliest samples appeared in May 2026, with attacker infrastructure traced back to February 2026.

Manic enables attackers to steal banking credentials, intercept one-time authentication codes, and gain remote control over infected Android devices. This compromises user financial accounts, government app data, cryptocurrency wallets, and two-factor authentication mechanisms. The malware’s ability to exfiltrate data without internet connectivity increases the risk of undetected data theft. Abuse of Accessibility services allows it to evade user detection and resist removal, prolonging infection and increasing potential damage.

No official patch or fix is available as this is malware rather than a software vulnerability. Protection focuses on avoiding installation by only downloading apps from trusted sources such as the official Google Play Store, which has not been observed distributing Manic. Users should deny Accessibility permissions to untrusted apps and monitor permissions granted to installed apps. Security solutions with Android malware detection capabilities may help identify and remove infections. Regularly updating device software and security apps is recommended. Since the malware can evade detection and persist via Accessibility abuse, users should be cautious about granting Accessibility permissions and consider resetting devices if infection is suspected.