Manic malware taps nearby devices to steal data

When a compromised Android phone loses its internet connection, most malware goes quiet. Manic, a newly analyzed Android trojan, simply finds another way out: it uses nearby infected devices as relays, passing stolen data over Wi-Fi Direct or Bluetooth until it reaches the attacker's command-and-control server.

This fallback mechanism, detailed by mobile security firm ThreatFabric, makes Manic particularly dangerous in environments where connectivity is intermittent or closely monitored. The malware has been active since at least February, combining spyware, banking fraud, and remote-control capabilities into a single package.

Wide Target List, Ukraine Focus

ThreatFabric's analysis shows Manic targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps. While the malware casts a wide net across Central and Western Europe, including the U.K., and Russia, its primary focus appears to be banking and government/eID applications in Ukraine, alongside global fintech and cryptocurrency services.

The researchers noted an expansion of the malware's infrastructure in the months following its initial discovery, suggesting active development and deployment.

Overlays and a UI Keylogger

Manic's core technique involves transparent overlays placed on the numeric keypads of legitimate applications. These overlays capture the victim's taps and reproduce them through Android Accessibility, allowing the genuine application to continue functioning normally while the user's input is silently logged.

Once the malware obtains Accessibility and notification access permissions, it can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions. Captured information is categorized by type, making it easier for attackers to exploit.

“Manic uses its Accessibility service as a UI keylogger,

ThreatFabric explains, adding that the malware “classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.”

Unusual Exfiltration: Wi-Fi Direct and Bluetooth Relays

Most malware relies on a direct connection to its command-and-control server to exfiltrate data. Manic's authors implemented a fallback that kicks in when the compromised device cannot reach the C2 server. In such cases, the malware encrypts the data and transfers it to nearby compromised devices over Wi-Fi Direct or Bluetooth connections.

According to ThreatFabric, “Manic first attempts to use an established Wi-Fi Direct peer, then queries Bluetooth and BLE peers to determine whether they have internet connectivity.” If necessary, the malware can use multi-hop routes, with newly queued items configured for a maximum of four relay hops by default.

This mechanism allows data exfiltration even from offline devices, as long as another infected device is within Wi-Fi or Bluetooth range. The relaying process is designed to be stealthy, avoiding direct internet traffic from the infected device that might be monitored.

Infection Vector and Evolution

ThreatFabric says the exact infection vector remains unknown. However, in late May, researchers observed the use of a wrapper that delivered the main payload to victims, followed by an expansion of the existing infrastructure in the months that followed.

In July, an updated wrapper with stronger anti-analysis checks and in-memory DEX loading was observed in attacks, and a new panel and API also rolled out. These updates suggest the operators are actively refining the malware to evade detection and improve its capabilities.

How to Protect Yourself

Android users are advised to avoid downloading APKs from obscure sources and unofficial portals, deny Accessibility permissions unless required by a trusted application, and regularly run Play Protect scans to detect and remove known malware.

Given Manic's ability to operate even in offline environments, users in high-risk regions, particularly Ukraine, should be especially vigilant about the apps they install and the permissions they grant.

Why It Matters

The Manic malware's relay-based exfiltration represents a notable evolution in mobile malware resilience. By leveraging peer-to-peer connections, it reduces reliance on a direct internet connection, making it more difficult to disrupt with network-level defenses alone. For organizations and individuals in high-risk regions, this suggests a need to consider not just device-level security, but also the potential for data to leave a device through unconventional channels. This could mean increased scrutiny of Bluetooth and Wi-Fi Direct activity on sensitive devices, and a heightened emphasis on the principle of least privilege for Accessibility permissions.