# Manic Android Malware Leverages Nearby Devices for Covert Data Exfiltration Mobile security researchers have uncovered **Manic**, a potent new Android malware family that has been active since at least February. This multi-functional threat combines elements of spyware, banking trojans, and remote access tools, primarily targeting users in Ukraine but also impacting other European countries.  ## Broad Target Scope and Evasion Tactics **Manic** has set its sights on a staggering 169 applications, encompassing banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA services. Its primary focus, however, appears to be Ukrainian banking and government platforms, alongside global fintech and cryptocurrency providers. Analysis by mobile security firm **ThreatFabric** reveals that **Manic** employs a clever evasion technique. It utilizes transparent overlays on the numeric keypads of legitimate applications to capture user taps. These captured inputs are then reproduced via Android Accessibility services, allowing the legitimate applications to function normally, all while the malware covertly records sensitive information.  ## Extensive Data Collection Capabilities Upon gaining Accessibility and notification access permissions, **Manic** can perform a wide array of malicious activities. This includes capturing lock PINs/passwords, intercepting notifications and SMS messages, collecting files and location data, monitoring screen activity, and providing remote control to its operators through **WebRTC** sessions. **ThreatFabric** highlights **Manic's** sophisticated keylogging capabilities: “**Manic** uses its Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.” This categorization makes the exfiltrated data more readily exploitable by the malware operators. .jpg) ## Innovative Multi-Hop Data Exfiltration One of the most notable features of **Manic** is its unusual and resilient data exfiltration mechanism. When a compromised device cannot establish a connection with its command-and-control (C2) server, the malware initiates a fallback strategy: it encrypts the stolen data and transfers it via nearby compromised devices using **Wi-Fi Direct** or **Bluetooth** connections. **ThreatFabric** researchers explain, "**Manic** first attempts to use an established **Wi-Fi Direct** peer, then queries **Bluetooth** and **BLE** peers to determine whether they have internet connectivity." The malware can even establish multi-hop routes, with newly queued items configured for up to four relay hops by default. This enables data exfiltration even from offline devices, provided another infected device is within range.  ## Evolving Infrastructure and Mitigation Advice While the exact initial infection vector remains unknown, researchers observed a wrapper delivering the main payload in late May, followed by an expansion of the malware's infrastructure. In July, an updated wrapper with stronger anti-analysis checks and in-memory **DEX** loading was detected, alongside a new control panel and **API**. To protect against **Manic** and similar threats, Android users are strongly advised to: * Avoid downloading **APKs** from unofficial or obscure sources. * Deny Accessibility permissions to applications unless absolutely necessary and from a trusted source. * Regularly run **Google Play Protect** scans to detect and remove known malware.