Manic: The Android Spyware That Steals Data Even When Offline
A new Android malware discovered that leaks data via Bluetooth.
1What is Manic?
Manic is a new Android malware that can steal data even when the device is offline. Discovered by ThreatFabric's Mobile Threat Intelligence team, this malware combines banking fraud and spyware capabilities. Active since at least February 2026, Manic primarily targets Ukrainian banks, government agencies, and messaging apps. It also affects financial institutions in Russia and Europe.
2Which apps does it target?
Manic monitors 169 different Android applications. Targets include banking and payment apps across various European countries, government and eID services, crypto exchanges and wallets, 2FA tools, messaging apps, browsers, and email clients. This broad coverage enables attackers to track a victim's money, messages, location, and files from the same device.
3How does it work?
After installation, Manic requests Accessibility and notification permissions. It uses the Accessibility service as a UI keylogger, recording lock screen inputs, recovery phrases, SMS codes, passwords, and other text. Each log contains details like app name, package information, captured text, timestamp, and input type. It also overlays an invisible layer on numeric keypads in targeted apps to steal PINs.
4Offline data exfiltration
Manic's most notable feature is its ability to exfiltrate data even when offline. Collected data is encrypted with AES-GCM and placed in a local queue. The malware then searches for nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT. Even if an infected phone loses internet connection, data can still leak through another infected device within radio range.
5Remote control capabilities
Manic allows remote device control via WebRTC. Attackers can view the screen and interact with it using Android's Accessibility features. The malware hides its activities using black screens, fake screens, or update messages. The July version removes itself from the device's app launcher for further concealment.
6Protection methods
Users are advised to monitor unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections. Such connections from devices not actively transferring files could indicate Manic's presence. Additionally, avoiding app installations from unknown sources and not clicking suspicious links are critical preventive measures.
7Scope and targets
Manic poses a particular threat to Ukraine, targeting Ukrainian banks, government and identity services, and messaging apps, along with financial institutions in Russia and Europe. Global fintech and cryptocurrency services, as well as military-focused communication tools, are also within its scope. This wide target range indicates a multifaceted data collection operation.
8Why should we be concerned?
Manic combines phishing, live screen monitoring, authentication interception, device takeover, and internet-independent data exfiltration. This combination creates a serious threat that can bypass traditional security measures. Financial institutions and organizations handling sensitive data urgently need to take precautions against Manic's risks.
Original article: Security Affairs — Manic: Çevrimdışıyken Bile Veri Çalan Android Casus Yazılımı