DEV Community

Anoymask
Anoymask

Posted on

Manic Android Malware: Information Theft via Transparent Overlays and Short-Range Device Relaying

#security #threatintel

1. Basic Information

  • Article Title: Manic: A blend between banking malware and spyware
  • Publisher: ThreatFabric
  • Publish Date: 2026-08-20
  • Severity: High
  • Original Source: ThreatFabric
  • Related Sources: New Manic Android malware can exfiltrate data through nearby devices
  • Related Malware: Manic
  • Threat Actor: None / Unidentified
  • CVE: None
  • Products/Technologies: Android, Wi-Fi Direct, Bluetooth RFCOMM, Bluetooth LE GATT, WebRTC

2. Executive Summary

This Android malware steals input on screens using transparent overlays. When it cannot connect to the internet, it moves stolen data between infected devices using Wi-Fi Direct or Bluetooth with up to 4 hops.

Reason for Severity: It targets 169 banking, government, eID, cryptocurrency, and authentication apps. It can steal and move information through nearby infected devices even without an online C2 connection.

3. Attack Flow

Device Infection and Input Theft

  1. The initial distribution method is not yet confirmed by public information. The malicious app uses packers to avoid analysis and loads DEX files in memory.
  2. It tricks users into granting Accessibility and Notification Access permissions.
  3. It shows a transparent overlay on the target app's numeric keypad and steals PINs based on where the user taps.
  4. It uses Accessibility to send the stolen taps to the real app. Because of this, the real screen keeps working normally.
  5. It collects SMS/notifications, screens, files, location, OTPs, and recovery phrases. It also uses WebRTC for remote control.

Offline Relaying Using Nearby Infected Devices

  1. An infected device that cannot connect directly to the C2 encrypts the collected data.
  2. It searches for nearby infected devices using Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT.
  3. It relays the data through up to 4 hops until it reaches an infected device with a direct internet connection.
  4. If it cannot find a path, it saves the data and tries again later, sending it to the C2 once a connected device is available.

4. Attacker Position and Execution Location

  • External attackers who manage the malicious Android app and the remote C2.
  • Runs as an app with Accessibility permissions on the victim device.
  • Uses other nearby infected devices as relay nodes.

5. Visibility for Victims and Administrators

Victims / Users

  • After granting permissions, banking, government, and authentication apps may look and work normally.
  • Because numbers are re-entered into the real app, users rarely notice anything is wrong unless an input fails.

Administrators / SOCs

  • Unknown apps with Accessibility/Notification Access, in-memory DEX loading, continuous Bluetooth/Wi-Fi Direct scanning, and WebRTC traffic are key indicators.
  • In corporate device management, you can check app permissions and short-range wireless usage.

6. Success and Failure Conditions

Success Conditions

  • The user installs the malicious app and grants Accessibility and other required permissions.
  • The user opens a target app and enters a PIN, OTP, or recovery phrase.
  • A direct connection to the C2 or another nearby infected device is available.

Failure Conditions

  • Blocking the installation of unmanaged apps and controlling Accessibility permissions.
  • Mobile Threat Defense (MTD) detecting overlays, in-memory DEX, and abnormal permissions.
  • Checking important transactions outside the mobile device, or using hardware keys and other theft-resistant authentication.
  • Turning off unnecessary Bluetooth and Wi-Fi Direct.

7. What Happens on Success

  • Theft of PINs, OTPs, and recovery phrases for banking, eID, cryptocurrency, and authentication apps.
  • Monitoring of SMS, notifications, files, screens, and location.
  • Remote control of the device.
  • Data leaks from network-isolated devices via nearby infected devices.

8. Observable Logs

Email

  • Email distribution has not been confirmed. There is no evidence that distribution links arrived via email.

Proxy / SWG / DNS

  • C2 traffic, WebRTC signaling, and data sent during direct connections. Relay source devices may not show outbound internet traffic.

Endpoint / EDR

  • Android app installation, Accessibility/Notification Access permissions, in-memory DEX loading, screen capture, and overlays on target apps.

Identity / IdP

  • Authentication and account recovery using stolen OTPs, PINs, or recovery phrases. Logins from different IPs or regions than the device's usual location.

SaaS / Cloud

  • MDM/MTD app lists, permissions, compliance status, and mobile authentication logs.

Network

  • Wi-Fi Direct group formation, Bluetooth RFCOMM/BLE GATT traffic, and device-to-device relaying up to 4 hops.

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): Only signs of malicious app distribution or installation. No confirmation of permission grants or execution.
  • User Interaction Confirmed: The user opens the app and grants Accessibility and Notification Access.
  • Initial Execution Confirmed: Any sign of overlays, screen capture, in-memory DEX loading, or device-to-device scanning.
  • Malware Execution or Authentication Success Confirmed: Manic C2 registration, remote control, or successful authentication using stolen info.
  • Information Theft or Session Compromise Confirmed: Collection of PINs/OTP/recovery phrases, creation of encrypted packages, and relaying or sending to C2.
  • Follow-on Compromise Confirmed: Financial transactions, account recovery, unauthorized logins to other accounts, etc.

"Attack Attempt Observed (Success Unconfirmed)" means suspicious requests or packages were found, but code execution or data theft is not yet proven. Upgrade the status level based on later evidence.

10. Investigation Playbook

Trigger

  • An unknown app holds Accessibility and Notification Access permissions.
  • Suspicious overlays appear on banking, eID, or authentication apps.
  • Abnormal Wi-Fi Direct or Bluetooth traffic between corporate devices.

Initial Check

  • Check the app name, signature, source, installation time, and permission grant time.
  • Compare target app usage times with authentication anomalies.

Endpoint

  • Collect APK/DEX files, permissions, Accessibility services, notification listeners, overlays, WebRTC, and wireless connection history.

Authentication / Cloud

  • Check authentication, OTPs, account recovery, and device registration changes in banking, eID, and corporate IdP systems.
  • Revoke sessions for affected accounts and re-register authentication factors.

Follow-on Action

  • Search for the same APK signature, C2, and short-range communication peers across all MDM/MTD systems.
  • Check nearby devices for signs of infection.

Containment

  • Isolate the device from the network and turn off Bluetooth and Wi-Fi Direct.
  • Factory reset the device after collecting evidence, and change credentials and recovery phrases from a safe separate device.

Severity Levels

  • Distribution / Installation only
  • Dangerous permissions granted
  • Information gathering functions executed
  • Data relayed / sent
  • Account or asset compromise confirmed

11. Defense and Detection Ideas

Single Event

  • Unmanaged apps granted Accessibility or Notification Access.
  • Overlays starting on banking or authentication apps.
  • Screen capture or WebRTC used by an unknown app.

Timeline Correlation

  • App installation -> Dangerous permissions -> Target app opened -> Transparent overlay -> Device-to-device communication -> Authentication anomaly.

Threat Hunting Perspective

  • Compare Accessibility service lists with high-value app usage times.
  • Investigate Bluetooth and Wi-Fi Direct peers even on devices without internet access.
  • Logins from a different region right after using an authentication app.

Log Gaps

  • Android Accessibility actions, overlays, short-range wireless, inter-app screen context, and personal device activity outside of MDM.

Priority Measures

  • Control permitted apps on corporate Android devices.
  • Audit Accessibility and Notification Access.
  • Use anti-phishing authentication and transaction verification.
  • Correlate MTD and IdP logs.

12. Facts / Inference / Hypothesis

Facts

  • Manic targets 169 banking, government, eID, payment, cryptocurrency, messaging, and authentication apps.
  • It steals taps using transparent overlays and re-enters them into real apps via Accessibility.
  • If it cannot connect directly to the C2, it relays data through Wi-Fi Direct/Bluetooth with up to 4 hops.
  • It collects SMS, notifications, screens, files, location, OTPs, and recovery phrases.
  • The initial infection vector is not confirmed in public sources.

Inference

  • You should assume that even devices with no visible outbound traffic may be passing data to nearby infected devices.
  • Because numeric keypads work normally, it is hard to detect threats based on user reports alone.

Hypothesis

  • Relay success rates may increase in crowded places where infected devices are close together, such as airports, meetings, or workplaces.

13. MITRE ATT&CK Mapping

  • T1406.002 – Obfuscated Files or Information: Software Packing (High Confidence)
  • T1417.002 – Input Capture: GUI Input Capture (High Confidence)
  • T1517 – Access Notifications (High Confidence)
  • T1429 – Audio Capture (Low Confidence): Public summaries show limited confirmation of audio collection.
  • T1113 – Screen Capture (High Confidence): Mapped for Enterprise ATT&CK convenience. T1513 is also considered for Android-specific mapping.
  • T1219 – Remote Access Software (Medium Confidence)
  • T1041 – Exfiltration Over C2 Channel (High Confidence)

14. Unknowns and Further Research

  • Initial distribution vector and threat actors.
  • Number of infected devices and actual cases of 4-hop relaying.
  • Whether local banking or government apps are included in the target list.
  • Full scope of IOCs and fraudulent transactions.

15. Impact on SOCs and Organizations

Organizations using BYOD, corporate Android devices, and authentication apps face the same risks of permission abuse. Security teams must link MDM/MTD data with IdP and financial fraud detection, and include short-range wireless monitoring in their investigations even for devices with no outbound internet traffic.

16. Summary by Target Audience

For SOC Teams

Correlate dangerous permissions, target app usage, short-range wireless activity, and authentication anomalies.

For Administrators

Control unmanaged apps and Accessibility settings, and ensure clear visibility through MDM/MTD.

For Users

Do not grant Accessibility or Notification Access to unknown apps. If you already granted these permissions, report it immediately.

Top comments (0)