Reported by 2 outlets

Timeline

1. original reporting

   Manic Android malware can exfiltrate data through nearby devices

   bleepingcomputer.com · 54d ago · August 20th, 2026

   A new Android malware named Manic targeting users in multiple European countries has a fallback mechanism for exfiltrating data through nearby infected devices. The malware has been active since at least February and combines spyware, banking fraud, and remote control capabilities. It targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps, with users in Ukraine being the primary focus. Mobile security company ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally. Overlays capturing user taps Source: ThreatFabric After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions. The captured information is categorized by type, making the data more readily exploitable for the malware operators. “Manic uses its Accessibility service as a UI keylogger,” ThreatFabric explains , adding that the malware “classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.” Manic's atta

2. update from malware.news

   Manic: Blend between Banking Malware & Spyware

   malware.news · 54d ago · August 20th, 2026

   ThreatFabric's Mobile Threat Intelligence (MTI) Team has identified a new Android threat actively distributed in the wild. The modern mobile threat landscape includes numerous malware families operated by individual threat actors and organised criminal groups, all competing for ways to infect victims as smoothly and inconspicuously as possible. Manic sits at the intersection of Android banking malware and mobile spyware , combining financial-fraud capabilities with broader surveillance and device-control features. Its targeting is strongly focused on Ukraine , covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. Article Link: Manic: Blend between Banking Malware & Spyware