A newly uncovered Android malware family, dubbed "Manic," has emerged as a dangerous hybrid of mobile banking fraud, credential theft, and spyware. Discovered by ThreatFabric's Mobile Threat Intelligence team, the malware targets sensitive information across an expansive list of 169 applications.

While it is capable of stealthy credential theft and remote device control, Manic introduces a sophisticated mechanism rarely seen in mobile threats: the ability to use nearby infected devices as relay nodes to move stolen data when an infected device has no direct Internet connection.

This development presents a significant challenge for mobile defenders because traditional network-isolation measures may not be sufficient when other compromised devices are within local radio range.

Key takeaway: Manic can potentially use nearby infected Android devices as communication relays, meaning that disconnecting a compromised phone from the Internet may not always be enough to stop data exfiltration.

---

1. How Manic Operates: The Stealth Toolkit

Many Android banking trojans use overlay-based attacks, displaying fake screens over legitimate applications to capture usernames, passwords, or other credentials. Manic, however, can use a much more subtle technique for capturing banking PINs.

Invisible Tap Logging

Once Manic obtains Accessibility and notification-related permissions, it can place a transparent layer over the numeric keypad of a targeted banking application. As the victim enters their PIN, the invisible layer records where the victim taps.

• Accessibility permissions provide the malware with extensive interaction capabilities.
• An invisible layer is placed over the targeted numeric keypad.
• The victim enters the PIN normally.
• The malware records the victim's tap locations.
• The input is passed through to the legitimate banking application.

The malware then uses Android's Accessibility functionality to pass the input through to the legitimate banking application. As a result, the transaction can continue normally while the PIN has already been captured by the malware.

This approach is particularly difficult for victims to notice because there may be no obvious fake login screen or interruption to the banking application.

Remote Device Control and Surveillance

Beyond banking credentials, Manic can target the device's screen-lock credentials, including PINs or patterns. It can also intercept SMS messages and notifications and establish WebRTC sessions that allow attackers to view and interact with the infected device remotely.

Combined with Accessibility-based control, these capabilities give attackers significant visibility into and control over a compromised Android device.

What makes this dangerous? The malware does not rely on a single technique. Credential theft, notification interception, screen monitoring and remote interaction can work together to give attackers broad access to a compromised device.

---

2. Peer-Relay Exfiltration: Bypassing Network Blocks

Manic's most distinctive feature lies in its communication architecture.

Normally, security teams can limit active data theft by disconnecting a compromised device from cellular and Wi-Fi Internet access. Manic introduces an additional challenge: an infected device without a direct Internet connection can store stolen information locally and attempt to communicate with another nearby infected device.

The malware can use technologies such as Wi-Fi Direct, Bluetooth, and Bluetooth Low Energy (BLE) to communicate with nearby infected devices.

How the Relay Works

---

If a nearby infected device has Internet connectivity, the disconnected device can use it as a relay for encrypted data. The connected device can then forward the information toward the attackers' infrastructure.

In this way, compromised Android devices can potentially form a chain of relay nodes. Reporting based on ThreatFabric's research indicates that the malware can support multiple relay links.

This means that disconnecting a single compromised phone from the Internet may not be sufficient to prevent data exfiltration if another infected device remains within local radio range.

Important: This should not be confused with defeating a true air gap. The relay mechanism depends on local wireless communication being available between infected devices.

---

3. The Target Profile: Strategic and Broad

ThreatFabric traces Manic's earliest infrastructure activity to February 2026, with development and production services appearing during March and April. A more advanced version observed in July 2026 introduced additional anti-analysis capabilities, including in-memory code loading and improved credential-theft functionality.

The malware currently monitors 169 applications across several important categories:

• Banks and Government/e-ID Services — with particularly strong targeting of Ukrainian financial and government services, alongside additional targets in Russia and other European countries.
• Fintech and Cryptocurrency Platforms — covering financial and cryptocurrency services.
• Messengers, Authentication and Communication Applications — including applications used for secure communications and services associated with military users.
• Other Sensitive Applications — including browsers, email applications and other software that may contain valuable credentials or personal information.

The breadth of the target list indicates that Manic is not limited to conventional banking fraud. Its capabilities allow attackers to collect credentials, messages, notifications and other sensitive information from a wide range of applications.

---

4. Editorial Analysis: What Manic Means for Cybersecurity

From a defensive perspective, Manic represents an important evolution in Android malware resilience.

Why Peer-Relaying Challenges Network Isolation

In enterprise cybersecurity, network isolation is a standard response when an endpoint is suspected of being compromised. Disconnecting the device from the Internet can prevent it from communicating directly with its command-and-control infrastructure.

Manic challenges this assumption by introducing another communication path.

In environments where multiple devices are physically close together—such as corporate offices, military facilities, public transportation environments, or other dense locations—an infected device without direct Internet access could potentially relay stolen information through another compromised device.

This does not make conventional network isolation useless, but it means security teams must also consider local wireless communication and the possibility of multiple compromised devices.

The Blurring Line Between Fraud and Surveillance

Manic's target list reveals capabilities extending beyond straightforward financial theft.

The malware targets banks and cryptocurrency services, but it also monitors authentication applications, messaging platforms, government services and other applications containing sensitive information.

This combination suggests that Manic can provide attackers with information that has value beyond direct financial fraud. While the available research does not establish a specific espionage campaign, the malware's surveillance and credential-theft capabilities could potentially provide significant intelligence value.

The Accessibility Services Dilemma

Android's Accessibility Service remains an important attack surface for mobile malware.

The service is designed to assist users with disabilities and provide legitimate applications with accessibility functionality. However, its ability to read screen content, monitor interactions and perform gestures can also provide malware with powerful control over a device when users grant inappropriate permissions.

As long as malicious or deceptive applications can convince users to grant Accessibility permissions, threats such as Manic and other Android malware families will continue to exploit this capability.

---

5. Defensive Recommendations

Mitigating a threat such as Manic requires a combination of user awareness, application controls and mobile security monitoring.

For Individuals

• Restrict Accessibility Permissions: Never grant Accessibility permissions to applications that do not have a clear and legitimate need for them. Be particularly cautious with unfamiliar applications requesting extensive device-control permissions.
• Avoid Untrusted APK Files: Avoid installing APK files from unofficial or untrusted sources. Researchers have not established the exact initial infection mechanism for Manic, so it is safer not to assume that sideloading is its confirmed primary infection vector.
• Keep Google Play Protect Active: Ensure Google Play Protect remains enabled and that the device receives regular security updates.
• Review Notification Access: Be cautious when an unfamiliar application requests permission to read notifications, as notifications may contain authentication codes, messages and other sensitive information.

For Organizations

• Monitor Nearby Device Communication: Organizations should consider Bluetooth, BLE and Wi-Fi Direct communication as part of their mobile-security threat model, particularly in environments where multiple managed devices operate in close proximity.
• Isolate Compromised Devices Completely: When a device is suspected of infection, security teams should consider disabling or restricting all unnecessary wireless communication, not simply disconnecting the device from cellular or Wi-Fi Internet access.
• Review Mobile Permissions: Monitor and control applications requesting Accessibility, notification and other high-privilege permissions.
• Use Mobile Threat Detection: Organizations should consider mobile endpoint security and application monitoring capable of identifying suspicious behavior and unauthorized device-control activity.

---

Conclusion

Manic demonstrates how Android malware is evolving beyond conventional banking trojans.

Its combination of credential theft, Accessibility-based device control, surveillance capabilities and peer-relay communication creates a particularly challenging threat model. Most notably, its ability to use nearby infected devices as communication relays means that Internet disconnection alone may not always prevent data from leaving a compromised device.

The key lesson: Mobile security is no longer only about what a device connects to. Defenders must also consider what other compromised devices may be operating around it.

The threat does not make traditional mobile-security controls obsolete, nor does it defeat a true air gap. Instead, it highlights the need for defenders to think beyond direct Internet connectivity and consider the entire local communication environment surrounding a compromised device.

For organizations and individuals, the lesson is straightforward: minimize unnecessary permissions, avoid untrusted applications, keep security protections enabled, and treat unexpected Accessibility, notification and device-control requests with extreme caution.