Manic Android Malware Combines Banking Fraud, Spyware and Wi-Fi Mesh Relays

Aug 20, 2026 · Original article ↗

Summary

ThreatFabric details Manic, an Android malware family focused on Ukraine that steals credentials, spies on victims and remotely controls devices. It can also relay encrypted data through nearby infected phones when direct internet access is unavailable.

Key points

Manic targets 169 app package IDs, including banking, cryptocurrency, government identity, messaging, browser and email apps, with a strong focus on Ukraine.
It captures credentials, PINs, SMS codes and recovery phrases using Accessibility and notification access, including input from legitimate banking-app keypads.
Operators can monitor screens, interact with devices remotely, collect files and messages, track location, and conceal activity behind fake or black screens.
Encrypted data can be stored for later transfer and relayed through infected peers using Wi-Fi Direct, Bluetooth RFCOMM or BLE, with routes of up to four hops by default.
The report traces activity to February 2026 and describes July updates including stronger anti-analysis checks, in-memory DEX loading and lock-secret phishing.

Article Details

Attack Vectors: Manic is distributed as Android malware and targets banking, payment, cryptocurrency, government and identity, messaging, browser, and email applications.
The malware uses Accessibility and notification access to capture input and authentication-related information, including lock secrets, passwords, one-time codes, and recovery phrases.
Manic captures keypad taps within legitimate banking apps and can attempt to enter a stored credential or pattern at the Android lock screen.
Operators can remotely view and interact with infected devices through WebRTC sessions, while concealing activity behind black, fake, or update screens.
Manic collects files and device data, queues encrypted packages locally, and can relay them through nearby infected devices using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT when direct C2 access is unavailable.

Indicators of compromise

Type	Indicator	Context
SHA256	`2884108b35eba7b8099087405653c1b23c3839f0d5058c4d61341fc31cfc6040`	SHA-256 hash of the May wrapper identified as a Manic indicator.
SHA256	`2fb5b01ea5a483d60b659e85327a53c6661bdd630d4afd93dc5fe0941d3ccbbe`	SHA-256 hash of the May Manic implant.
SHA256	`7c12f1237090e32c18583f66f1a9e44b029ad7c1e61179e1d524fb3093abd59a`	SHA-256 hash of a Manic implant sibling.
SHA256	`80be0942d0e20b5006e240434f42512c8b3cd0d54eee858a25663c1a4224a576`	SHA-256 hash of the July wrapper identified as a Manic indicator.
SHA256	`e7abc375f24d0dd2419e0bce4686c7301b3ee82ae38906c67d3481580f6c648e`	SHA-256 hash of the primary Manic implant.
SHA256	`feea425cde1223fe7afdd7a1ea631678ec6282f6cc20c3d3c0fb97cdbcf65b9b`	SHA-256 hash of the July dropped implant identified as a Manic indicator.