New Android malware attacks banks and e-IDs

Security researchers have discovered a new Android malware called Manic, which combines banking Trojan, spyware, and remote control and can relay stolen data through infected devices nearby when there is no direct internet connection.

Security firm ThreatFabric has identified a new family of malicious Android code that combines financial fraud, surveillance, and remote control.

The malicious code has been named Manic and has been active since at least February 2026. Ukraine is the primary target, but it also monitors applications used by banks, governments, and e-identification services in several European countries.

• 

  ADVERTISEMENT

  
  

• 

  OWN CONTENT

  
  

• 

  SPONSORED

  
  

• 

  ADVERTISEMENT

  
  

ThreatFabric has identified 169 packet identifiers that Manic monitors. They include banks, payment services, crypto exchanges, digital wallets, e-IDs, authentication apps, messaging services, browsers and email clients.

Can record input in real apps

Manic abuses Android's accessibility features to monitor and control the infected device.

Malicious code can record the user's keystrokes on the numeric keypad in a legitimate banking app. The keystrokes are simultaneously sent to the real application, allowing the banking app to continue functioning normally while the input is recorded.

Manic can collect, among other things:

• Passwords and screen lock codes.
• One-time codes from SMS and notifications.
• Recovery phrases for crypto wallets.
• Email logins.
• Files, contacts and call history.
• Position information.
• Content from the screen and messaging services.

The attacker can also establish a WebRTC session to observe the screen and remotely control the device.

Infected phones can forward data

The most unusual feature is a system for sending stolen data via other infected Android devices.

If a compromised phone cannot reach the attackers' command server directly, Manic searches for infected devices nearby. Communication can occur via Wi-Fi Direct, classic Bluetooth, or Bluetooth Low Energy.

Collected files and command responses are encrypted with AES-GCM and placed in a local queue. A nearby infected device with an internet connection can then forward the information.

The technology also supports multiple relay links. ThreatFabric have observed configurations where information can be sent through up to four infected devices before reaching the attackers' infrastructure.

This means that disconnecting from the internet does not necessarily stop data transmission if another infected phone is within radio range.

Exact method of spread has not been determined

Researchers have not yet determined how the initial infections occur. Analyzed versions use a separate installation component that delivers the main malicious code.

An updated version observed in July includes enhanced features to make analysis more difficult, loading code directly into memory, and methods to steal the device's lock code.

According to ThreatFabric, the development indicates that Manic is still actively developing.

Businesses should control Android permissions

Organizations that allow Android devices to access corporate data should check installations from unknown sources and monitor how accessibility permissions are used.

Users should avoid APK files from unofficial websites, deny accessibility access to apps that don't need it, and use Google Play Protect.

Enterprises with managed mobile devices can also use MDM or MTD platforms to block installation from unknown sources, inventory installed packages, and identify abnormal permissions.