Overview
- Researchers published technical details on Aug. 20–21, 2026, identifying Manic as a new Android threat that mixes banking‑fraud tools with broad spyware and remote‑control features.
- Manic stages collected files in an encrypted queue and searches for nearby infected peers over Wi‑Fi Direct, Bluetooth RFCOMM or BLE GATT, supporting up to four relay hops to forward data toward command‑and‑control servers.
- The malware depends on Accessibility and notification access to log UI input, place invisible overlays to capture PIN taps, intercept SMS and notifications, monitor the screen via WebRTC and automate UI actions including attempts to disable Play Protect.
- ThreatFabric says Manic watches 169 package IDs covering banks, payment and crypto apps and government eID services with a primary focus on Ukraine, and is distributed through phishing sites and dropper APKs identified by several wrapper and implant package names.
- Users and defenders should avoid sideloading APKs, deny accessibility and notification grants to untrusted apps, run Play Protect scans, and look for unexplained Wi‑Fi Direct or Bluetooth group activity because the offline mesh makes simple network isolation less effective.