As reported by SecurityAffairs, ThreatFabric's Mobile Threat Intelligence team has uncovered Manic, an Android malware strain that represents a concerning evolution in mobile threat design — one that specifically undermines the assumption that air-gapped or offline devices are safe from data exfiltration.

Threat Alert: As reported by SecurityAffairs, ThreatFabric's Mobile Threat Intelligence team has uncovered Manic, an Android malware strain that represents a concerning evolution in mobile threat design — one that specifically undermines the assumption that air-gapped or offline devices are safe from data exfiltration.

The most technically significant aspect of Manic is its Bluetooth relay mechanism for command-and-control communication. Traditional mobile malware detection strategies often assume that cutting network connectivity — through airplane mode, restricted Wi-Fi, or isolated environments — will neutralize active infections. Manic's ability to exfiltrate collected data via Bluetooth pairing to a relay device breaks that assumption entirely. This is a technique previously theorized in academic research and observed in limited nation-state contexts, but its appearance in financially-motivated malware targeting Ukrainian and European banking users signals a capability transfer that defenders must account for.

Why This Matters Beyond the Target Set

While Manic's current targeting is concentrated on Ukrainian banks, government services, and European financial institutions, the 169-app coverage and modular architecture suggest the infrastructure is designed for rapid retargeting. The inclusion of crypto wallets, 2FA applications, messaging platforms, and military communications apps indicates a dual-purposed design — financial fraud and intelligence collection — which is increasingly common in threats operating in conflict-adjacent regions.

The lock-secret phishing technique is particularly noteworthy. By presenting a fake lock screen prompt before the legitimate one appears, Manic extracts the device PIN or unlock pattern — credentials that cannot be easily rotated like passwords. This grants persistent access even if the victim later removes the malware, since the attacker retains the unlock credential for physical access scenarios.

Key Technical Concerns

Manic's in-memory DEX loading and anti-analysis checks indicate active development by a capable team iterating on detection evasion. The Accessibility Service abuse as a classified UI keylogger — one that distinguishes between recovery phrases, SMS codes, passwords, and ordinary text — represents a level of sophistication above typical Android banking trojans.

Who Is Most at Risk

Who Is Most at Risk
Ukrainian users — primary targeting zone covering banking, government eID, and military communications
European banking customers — secondary targeting across multiple countries' financial apps
Cryptocurrency users — exchange and wallet apps included in the 169-app target list
BYOD environments — any organization allowing personal Android devices on corporate networks where a compromised phone could serve as a Bluetooth relay node inside the perimeter
Field-deployed personnel — military, NGO, or journalist operations in regions where offline security assumptions are operationally critical

Shield53 Recommendations

Defenders should treat Manic as a signal that mobile threat detection must evolve beyond network-centric monitoring.

  • Bluetooth monitoring: Deploy MDM or EDR with Bluetooth event logging. Alert on unexpected pairing events, especially on devices that should be in restricted or offline environments. Investigate any paired device that cannot be identified by the user.
  • Accessibility Service governance: Audit all Android devices under management for Accessibility Service permissions. Implement allowlisting — only approved accessibility tools (screen readers, password managers) should hold this permission. Any unapproved app requesting Accessibility access should trigger immediate isolation.
  • Notification listener audits: Manic leverages notification access to intercept 2FA codes. Review which apps hold notification listener permissions and revoke from any non-essential applications.
  • Mobile threat defense deployment: If not already in place, deploy mobile-specific threat detection (e.g., Google Play Protect for unmanaged, MTD solutions for managed) that can identify in-memory DEX loading and Accessibility abuse patterns.
  • User awareness: Brief at-risk users — particularly those in Ukraine or handling sensitive communications — on the fake lock screen phishing technique. Emphasize that if a lock screen prompt appears at an unexpected time or looks visually different, the device should be treated as potentially compromised.
  • Incident response preparation: Update mobile IR playbooks to account for Bluetooth-based exfiltration. Standard containment (airplane mode, Wi-Fi disable) is insufficient. Physical device isolation or Faraday containment may be required for high-risk scenarios.
  • Threat hunting: Search endpoint telemetry for indicators of Accessibility service abuse — specifically apps requesting accessibility permissions followed by unusual foreground service activity or background data collection patterns.

Manic's existence confirms a trend Shield53 has been tracking: the convergence of financially-motivated cybercrime and intelligence-collection capabilities in mobile malware. The offline exfiltration channel is the element defenders cannot afford to ignore — it invalidates a containment strategy that many organizations still rely on for mobile incident response.