Manic Android Malware Can Steal Data Even When Your Phone Is Offline

A newly discovered Android malware called Manic is targeting banks, government services, and military communications across Ukraine, Russia, and Europe — and it can exfiltrate stolen data even when an infected device has no internet connection.

Cybersecurity firm ThreatFabric published a technical report on August 20, 2026, revealing that Manic uses nearby infected devices as relay points to transmit stolen data to attacker-controlled servers. The discovery marks a significant escalation in mobile threat sophistication and raises urgent questions about how organizations and individuals protect sensitive data in an era where simply going offline is no longer a reliable defense.

---

What Manic Does and Who It Targets

ThreatFabric describes Manic as sitting "at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features." The malware monitors 169 package IDs spanning banks, cryptocurrency wallets, peer-to-peer payment apps, Buy Now Pay Later services, government identity platforms, messaging apps, and email clients.

Ukrainian institutions appear to be the primary focus. The target list also includes applications used across Russia, Central and Western Europe, and the United Kingdom. The breadth of targeting tells a revealing story — Manic is not a single-purpose banking trojan. Its reach into military-focused messaging apps and government identity services suggests the operator wants visibility into a victim's finances, communications, and physical location simultaneously. Understanding the full scope of this threat requires awareness of how mobile malware attacks are evolving and why they are increasingly difficult to contain using conventional defenses.

The malware is distributed through phishing sites and dropper apps impersonating everyday utilities. Four APK package names have been identified as linked to the wrapper and implant components:

• tech.intel.dialer.updater
• org.honor.secure.helper
• org.lenovo.storage.processor
• dev.huawei.media.helper

These names are deliberately crafted to mimic legitimate device utilities from recognizable hardware brands, making them harder for users to identify as suspicious at a glance.

ThreatFabric traced Manic's activity to February 2026, when the first domain was registered using a fabricated persona. Active development followed shortly after, with a booking app lure serving as the first wrapper. The implant surfaced by late May. Development paused from late June to mid-July before a second deployment emerged around July 13, incorporating stronger anti-analysis checks and the ability to phish lock screen secrets. The corresponding control panel went live between July 24 and 28.

The pace of development — from initial domain registration to a fully functional control panel in under six months — signals a capable and well-resourced threat actor.

---

A Surprisingly Long List of Dangerous Capabilities

Manic abuses Android's accessibility services and notification permissions to carry out an extensive range of malicious actions. To appreciate how unusual this breadth of capability is, it helps to understand the different types of malware and how most threats specialize in a single attack vector rather than combining financial fraud, surveillance, and device control into one package.

How Manic Captures Data From Your Device

Among its most dangerous capabilities are:

• Intercepting keypad inputs to collect passwords and one-time codes
• Operating as a UI keylogger to record text and the app context in which it was entered
• Conducting remote device surveillance over a WebRTC session
• Taking screenshots and exporting contacts, call history, SMS messages, and notifications
• Sending SMS messages from the victim's device
• Displaying fake notifications and locking the device screen
• Attempting to disable Google Play Protect through UI automation

The Transparent Overlay PIN Capture Technique

One particularly stealthy technique involves capturing PIN codes without displaying a fake banking screen. Manic places a transparent overlay on top of a legitimate numeric keypad. When the user taps the overlay, the malware records the exact tap position and the nearby interface element. It then briefly disables touch interception and replicates the tap on the actual keypad — allowing the legitimate app to function normally while the attacker silently captures the PIN in the background.

This technique is especially dangerous because the victim receives no visual indication that anything is wrong. The app behaves exactly as expected.

Persistence is maintained through background workers, alarms, and accessibility and notification services. These components handle command-and-control communication, upload queued data, and synchronize what ThreatFabric calls the "offline mesh" at intervals of every 10 to 15 minutes depending on the build.

---

The Mesh Relay Technique That Makes Offline Devices a Threat

The most alarming innovation in Manic is its store-and-forward relay mechanism. If an infected device cannot reach the attacker's command-and-control server, the malware searches for another compromised Android device nearby and routes stolen data through it instead.

How the Relay Process Works

The process works in three stages:

1. Collected files and command results are staged in an encrypted format and placed in a local queue.
2. The malware scans for infected peers using Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT.
3. If a peer device is found, the encrypted package is relayed to it and forwarded toward the command-and-control server.

Manic supports up to four relay hops by default, meaning data can bounce through a chain of compromised devices before reaching its destination. If no peers are located, the data remains in the queue and the process retries later. "Each newly queued item receives a four-hop relay limit by default, although the configuration can change that value," ThreatFabric told The Hacker News.

Why Going Offline Is No Longer Enough

This architecture means that taking an infected phone offline does not guarantee protection. As long as another compromised device is physically nearby — in an office, a coffee shop, or a shared workspace — Manic can use it as a gateway. The threat is reminiscent of the fictional hive-mind networks popularized in sci-fi thrillers, except this one is operating in real environments right now.

For enterprise security teams, this reinforces the case for robust mobile device management practices that go beyond perimeter controls and address device-level threats across an entire fleet — not just those connected to the corporate network.

Google's Response and the Current State of Risk

Following publication of ThreatFabric's report, Google confirmed that no apps containing Manic were found on Google Play. A Google spokesperson stated that Android users are automatically protected against known versions of the malware by Google Play Protect, which is enabled by default on Android devices with Google Play Services. The company updated its statement on August 21, 2026.

ThreatFabric noted that the evolution observed between May and July 2026 — including stronger anti-analysis measures and lock-secret phishing — indicates Manic remains under active development and continues to expand its capabilities. For deeper technical context on how ThreatFabric analyzed the malware's command infrastructure, their full report is available at ThreatFabric's research blog.

What Organizations and Individuals Should Do Now

For readers and organizations monitoring this threat, three immediate priorities stand out:

Disabling internet access on a compromised device is insufficient if other infected devices are present nearby, making network-wide device auditing essential for enterprise security teams.

Organizations handling sensitive financial or government data should audit accessibility service permissions across their mobile device fleets and restrict sideloading from unofficial sources.

Individuals should verify that Google Play Protect is active on their devices and treat any app requesting accessibility permissions with significant caution regardless of how legitimate it appears.