Full Report
A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices. [...]
Analysis Summary
# Tool/Technique: Manic
## Overview
Manic is a sophisticated Android malware family that functions as a hybrid between a banking trojan and spyware. Its most distinguishing feature is a "mesh-network" style fallback exfiltration mechanism, which allows the malware to relay stolen data through nearby infected devices via Bluetooth or Wi-Fi Direct if a direct connection to the Command and Control (C2) server is unavailable.
## Technical Details
- **Type:** Malware (Banking Trojan / Spyware)
- **Platform:** Android
- **Capabilities:** Overlay attacks, UI keylogging (Accessibility Service), SMS interception, remote control (WebRTC), and multi-hop data relaying.
- **First Seen:** February 2026 (Active infrastructure expansion noted through July 2026)
## MITRE ATT&CK Mapping
- **[TA0031 - Initial Access]**
- **T1444 - User Execution:** Likely distributed via malicious APKs/wrappers.
- **[TA0034 - Persistence]**
- **T1624.001 - Event Notification Service:** Using Accessibility Services and Notification Access.
- **[TA0037 - Command and Control]**
- **T1518 - Ad Hoc Flooding:** Use of Wi-Fi Direct and Bluetooth for peer-to-peer data relay.
- **T1437 - Standard Application Layer Protocol:** Use of WebRTC for remote control sessions.
- **[TA0035 - Collection]**
- **T1417.001 - Input Capture:** Keylogging via Accessibility Services.
- **T1512 - Screen Capture:** Monitoring screen content.
- **T1636.002 - SMS Messages:** Intercepting 2FA codes and messages.
- **[TA0030 - Defense Evasion]**
- **T1406 - Obfuscated Files or Information:** In-memory DEX loading and anti-analysis checks in updated wrappers.
## Functionality
### Core Capabilities
- **UI Keylogging:** Uses Android Accessibility Services to monitor and categorize text input (PINs, recovery phrases, passwords, and 2FA codes).
- **Transparent Overlays:** Deploys overlays on numeric keypads of 169 targeted apps (banking, crypto, eID) to capture taps while allowing the underlying app to function.
- **SMS & Notification Interception:** Steals incoming messages to bypass multi-factor authentication.
- **Remote Access Trojan (RAT):** Provides operators with remote control capabilities via WebRTC sessions for real-time interaction.
- **Data Categorization:** Automatically sorts stolen data (e.g., "lock-screen input" vs "recovery-phrase") to streamline exploitation.
### Advanced Features
- **Peer-to-Peer Exfiltration:** If the C2 is unreachable, Manic searches for nearby infected peers using Wi-Fi Direct and Bluetooth/BLE.
- **Multi-Hop Relaying:** Supports up to four relay hops by default to pass encrypted data from an offline device to one with internet connectivity.
- **Enhanced Wrappers:** Recent variants utilize in-memory DEX loading and advanced anti-analysis checks to evade detection.
## Indicators of Compromise
- **File Hashes:** [Specific SHA256 hashes not provided in the source text; analysis suggests looking for wrappers delivering payload DEX files]
- **Network Indicators:**
- C2 infrastructure expanded significantly in mid-2026.
- Usage of WebRTC protocols for remote sessions.
- **Behavioral Indicators:**
- Requests for "Accessibility Service" permissions.
- Requests for "Notification Access."
- Unexpected activation of Bluetooth or Wi-Fi Direct interfaces.
- High frequency of `dex` loading into memory from a wrapper application.
## Associated Threat Actors
- Unknown (Current activity focuses on Ukraine, UK, Russia, and Western Europe).
## Detection Methods
- **Signature-based detection:** Monitoring for known Manic wrapper patterns and DEX payload signatures.
- **Behavioral detection:** Flagging applications that request Accessibility Services and subsequently attempt to create Wi-Fi Direct peer connections.
- **System Monitoring:** Detecting overlay activity on top of sensitive banking or government eID applications.
## Mitigation Strategies
- **User Education:** Advise against side-loading APKs from unofficial sources or obscure websites.
- **Permission Hardening:** Restrict "Accessibility Services" and "Notification Access" to only highly trusted, vetted applications.
- **Security Software:** Use Google Play Protect and reputable mobile security suites to scan for known malicious signatures.
- **Network Policy:** In enterprise environments, monitor for unusual P2P communication (Bluetooth/Wi-Fi Direct) between mobile devices.
## Related Tools/Techniques
- **Anubis / Ermac / Medusa:** Similar Android banking trojans utilizing Accessibility Services for overlays.
- **Bridgefy / FireChat:** Legitimate SDKs/apps using similar mesh-networking techniques for communication without internet.