Manic Android Malware Uses Peer-to-Peer Relays to Steal Banking Data

A sophisticated Android malware dubbed "Manic" is targeting users across Europe, deploying a hybrid of spyware and banking fraud capabilities to steal sensitive credentials. The malware focuses heavily on Ukrainian banking and government infrastructure, though its reach extends into the U.K., Russia, and other parts of Central and Western Europe.

According to research from ThreatFabric and BleepingComputer, Manic targets at least 169 different applications, including banking, payment, crypto wallets, messaging, and government eID apps. To capture data, the malware employs transparent overlays on numeric keypads and leverages Android Accessibility services. ThreatFabric notes that Manic uses its Accessibility service as a UI keylogger, allowing it to record user taps and steal lock PINs, passwords, and two-factor authentication (2FA) codes. Beyond credential theft, the malware can intercept SMS messages and notifications, collect precise location data, and establish remote control of the device via WebRTC sessions.

A New Frontier in Exfiltration

What distinguishes Manic from traditional mobile threats is its fallback exfiltration mechanism. When the malware cannot reach its command-and-control (C2) server, it can relay encrypted data through nearby compromised devices using Wi-Fi Direct or Bluetooth. This peer-to-peer method supports up to four relay hops by default, allowing data to "jump" from one infected device to another until it reaches a peer with an active internet connection.

This capability represents a significant escalation in mobile malware persistence. By removing the requirement for a direct internet connection to the C2 server, Manic can operate in restricted network environments or during outages. This makes the malware significantly harder to detect and mitigate using traditional network-based security tools, which typically look for direct communication between a victim's device and a known malicious server.

Evolution and Evasion

Manic has been active since at least February, but it continues to evolve to evade security researchers. In July, analysts observed an updated wrapper for the malware that introduced stronger anti-analysis checks and in-memory DEX loading. These techniques are designed to hide the malware's true intent from antivirus scanners and sandbox environments by loading the malicious code directly into memory rather than storing it as a detectable file on the disk.

Security experts are now monitoring how this multi-hop relay technique might be adopted by other threat actors. As the malware's infrastructure expands and its evasion techniques sharpen, the focus remains on the vulnerability of Android Accessibility services, which continue to be a primary vector for high-impact mobile fraud.