Full Report
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud
Analysis Summary
This summary provides an overview of the "Manic" Android malware based on the technical report provided.
# Tool/Technique: Manic
## Overview
Manic is a sophisticated hybrid of Android banking malware and mobile spyware. It is designed to facilitate financial fraud through credential harvesting and overlay attacks, while simultaneously providing deep surveillance capabilities. A standout feature of this malware is its ability to exfiltrate data from devices without an active internet connection by using a Wi-Fi mesh network to relay information through other nearby infected devices.
## Technical Details
- **Type:** Malware (Hybrid Banking Trojan / Spyware)
- **Platform:** Android
- **Capabilities:** Accessibility service abuse, overlay attacks, remote device control (WebRTC), location tracking, Wi-Fi mesh data relay, and UI keylogging.
- **First Seen:** February 2026 (Domain registration); Active deployment observed May–July 2026.
## MITRE ATT&CK Mapping
- **[TA0030 - Persistence]**
- **T1624.001 - Event Triggered Execution: Accessibility Service**
- **[TA0037 - Command and Control]**
- **T1573 - Encrypted Channel (WebRTC)**
- **T1020 - Automated Exfiltration (Mesh Relay)**
- **[TA0033 - Input Capture]**
- **T1417.001 - Input Capture: Keylogging (UI Keylogging via Accessibility Services)**
- **T1512 - Screen Capture**
- **[TA0040 - Impact]**
- **T1458 - Communication Denial (Blocking user view via black/update screens)**
## Functionality
### Core Capabilities
- **Accessibility Services Abuse:** Used to intercept UI interactions, record text, and grant itself permissions without user consent.
- **Financial Fraud:** Monitors 169 specific package IDs (banks, crypto, e-wallets) to serve fake overlays and capture login credentials/MFA codes.
- **Data Exfiltration:** Steals SMS, call logs, contacts, and files.
- **Remote Surveillance:** Real-time screen monitoring and device interaction via WebRTC sessions.
### Advanced Features
- **Wi-Fi Mesh Relay:** Enables "offline" data exfiltration by jumping data between infected devices until one with internet access can upload it to the C2.
- **Transparent Overlays:** Captures lock screen secrets and PINs by placing a transparent layer over the legitimate keypad, recording the tap coordinates, and then passing the tap through to the real app.
- **Security Evasion:** Detects and attempts to disable Google Play Protect via UI automation.
## Indicators of Compromise
- **File Names (Package IDs):**
- `tech.intel.dialer.updater` (Wrapper)
- `org.honor.secure.helper` (Wrapper)
- `org.lenovo.storage.processor` (Implant)
- `dev.huawei.media.helper` (Implant)
- **Behavioral Indicators:**
- Requests for "Accessibility Services" permission from utility or downloader apps.
- Unexpected Wi-Fi or Bluetooth activity in the background.
- Presence of overlays that block the screen or look slightly different from standard app logins.
## Associated Threat Actors
- **Currently Unattributed:** The activity is currently linked to campaigns targeting Ukrainian, Russian, and European sectors, though no specific named APT has been publicly linked yet.
## Detection Methods
- **Signature-based:** Scanning for known package IDs and MD5 hashes associated with the "Wrapper" and "Implant" APKs.
- **Behavioral Detection:** Monitoring for apps that abuse Accessibility APIs to interact with banking or messaging application UI elements.
- **Network Monitoring:** Identifying traffic to known Command and Control (C2) infrastructure and unusual P2P Wi-Fi mesh communication between mobile devices.
## Mitigation Strategies
- **App Governance:** Only download applications from the official Google Play Store and avoid sideloading APKs from phishing or "update" sites.
- **Permission Auditing:** Regularly review apps with "Accessibility" permissions; very few apps genuinely require this high level of access.
- **User Training:** Educate users on the risks of "update" screens or overlays that appear suddenly when opening a sensitive app.
- **Endpoint Protection:** Utilize mobile threat defense (MTD) solutions that can detect UI automation and overlay attacks.
## Related Tools/Techniques
- **Vultur/TeaBot:** Similar use of Accessibility services for remote screen streaming and banking fraud.
- **Mesh Networking Malware:** Similar concepts have been explored in theoretical research (like "BlueBorne" or specific IoT worms) but are rare in mainstream mobile banking trojans.