Executive Summary
Manic is a newly identified Android malware family emerging in early 2026 that functions as both a banking trojan and comprehensive spyware. It primarily targets users in Ukraine—covering national banks, identity portals, and military-focused messaging apps—but its reach extends across Russia, Poland, Germany, and the UK. The malware is designed for complete Device Takeover (DTO), enabling attackers to interact with financial applications in real-time while monitoring all user communications.
Technically, Manic is distinguished by its 'store-and-forward' exfiltration mechanism. If an infected device loses internet connectivity, it uses Wi-Fi Direct, Bluetooth, or BLE to relay encrypted stolen data to other nearby infected devices that have active internet access. Furthermore, it avoids traditional overlay phishing by using a transparent layer over legitimate app keypads to log PINs via Accessibility Services, replaying the taps to the original app to avoid detection by the user.
For organizations, Manic represents a significant risk to mobile-first financial workflows and secure communications. Its ability to maintain a 'self-healing' mesh network for data theft makes it highly resilient against traditional network isolation tactics. Security teams should prioritize monitoring for unauthorized Accessibility Service requests and unusual peer-to-peer radio activity on mobile endpoints.