Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
Summary: ThreatFabric reported that a new Android malware family codenamed Manic targets Ukrainian banks, government and identity services, and messaging apps, along with Russian and European financial institutions, fintech and cryptocurrency services, and military-focused communications, monitoring 169 package IDs. Manic abuses Android accessibility and notification permissions to capture lock screen secrets, PIN codes via transparent overlays, and device data, and adds a Wi-Fi mesh store-and-forward relay that lets an offline infected phone exfiltrate data through a nearby compromised device with up to four relay hops by default.
What you should know: Disconnecting an infected phone from the internet no longer stops exfiltration, because Manic can hand the data to another compromised Android device nearby - so containment has to account for every infected handset in physical range, not just the one you isolated.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026