Manic

Export contacts, call history, SMS messages, and notifications

Distributed via malicious websites and droppers, the malware enables attackers to log keystrokes, display phishing screens, and remotely control the compromised phone for banking and cryptocurrency fraud.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh

By July, an updated wrapper introduced stronger anti-analysis checks, in-memory DEX loading, and lock-secret phishing.

уже в июле появилась обновленная версия с усиленным антианализом и загрузкой DEX в память.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build.

After obtaining Accessibility and notification access, the malware can capture the victim’s lock secret and use overlays or fake screens to conceal activity. Manic uses its Accessibility service as a UI keylogger.

Like other Android malware families, Manic achieves its goals by abusing Android's accessibility services and notification permissions, effectively allowing it to capture lock screen secrets or serve fake overlays to gather sensitive data or conceal malicious activity by showing black or update screens.

Persistence relies on background workers, alarms, and the Accessibility and notification services. These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh, with periodic execution every 10 to 15 minutes depending on the build.

After obtaining Accessibility and notification access, the malware can capture the victim’s lock secret and use overlays or fake screens to conceal activity. Manic uses its Accessibility service as a UI keylogger.

Like other Android malware families, Manic achieves its goals by abusing Android's accessibility services and notification permissions, effectively allowing it to capture lock screen secrets or serve fake overlays to gather sensitive data or conceal malicious activity by showing black or update screens.

“Manic’s main trick relies on abusing Android’s Accessibility services” ... once permission is granted, the app can see text and buttons, interact with them, scroll through pages, and carry out actions automatically.

“If it finds one with internet access, it hands over the encrypted data to that phone, which then forwards it on to the attackers’ server.”

Чтобы скрыть происходящую на телефоне вредоносную активность от жертвы, Manic умеет показывать ей черный экран или имитировать обновление системы.

Delete a selected local file

уже в июле появилась обновленная версия с усиленным антианализом

It can hide its activity with black screens, fake screens or fake update messages, while also covering permission requests. | The July version goes a step further by removing itself from the device’s app launcher. This keeps it out of the normal app list and lets attackers activate it through its wrapper or a deep link.

By July, an updated wrapper introduced stronger anti-analysis checks, in-memory DEX loading, and lock-secret phishing.

уже в июле появилась обновленная версия с усиленным антианализом и загрузкой DEX в память.

By July, an updated build had added stronger anti-analysis checks, in-memory DEX loading, and a technique the researchers call lock-secret phishing...

“Attackers use this to ... interfere with attempts to uninstall it, [and] switch off security protections.”

“It automatically recognizes what kind of information it has just captured and sorts it into categories: passwords, email logins, four-to-six-digit SMS codes, strings of characters that look like crypto wallet seed phrases, and phone unlock codes or pattern locks.”

“It can generate an invisible keyboard that overlays the phone’s real one. When a user types their password ... Manic records exactly which keys they pressed.”

On top of these capabilities, Manic can capture PIN codes by serving a transparent overlay atop the legitimate numeric keypad in the targeted app.

It then briefly turns off touch interception and proceeds to replicate the tap on the actual keypad at the same position by taking advantage of the accessibility services API.

Browsers / mail Session harvest

The malware applies a similar trick to the lock screen itself, attempting to capture and later reuse the device’s unlock code or pattern.

Obtain a list of installed apps

Delete a selected local file

уже в июле появилась обновленная версия с усиленным антианализом

In addition, Manic includes spyware capabilities such as notification monitoring, location tracking, file harvesting, and remote device surveillance.

“It automatically recognizes what kind of information it has just captured and sorts it into categories: passwords, email logins, four-to-six-digit SMS codes, strings of characters that look like crypto wallet seed phrases, and phone unlock codes or pattern locks.”

“It can generate an invisible keyboard that overlays the phone’s real one. When a user types their password ... Manic records exactly which keys they pressed.”

On top of these capabilities, Manic can capture PIN codes by serving a transparent overlay atop the legitimate numeric keypad in the targeted app.

It then briefly turns off touch interception and proceeds to replicate the tap on the actual keypad at the same position by taking advantage of the accessibility services API.

The collected files and command results are staged in an encrypted format and placed in a local queue

В этом случае Manic сохраняет собранные данные на устройстве и начинает искать поблизости другие зараженные смартфоны.

Это позволяет малвари перехватывать SMS и уведомления, похищать файлы, список контактов и историю звонков, отслеживать геолокацию пользователя, делать скриншоты и удаленно управлять устройством через WebRTC.

“the malware also asks for permission to read text messages and notifications. That lets attackers intercept two-factor authentication codes and one-time verification codes.”

Export contacts, call history, SMS messages, and notifications

The collected files and command results are staged in an encrypted format and placed in a local queue

These components maintain C2 communication, process commands, upload queued data, and synchronize the offline mesh

Manic передает ему зашифрованные данные, а тот уже пересылает их на командный сервер злоумышленников. Более того, данные могут передаваться по цепочке через несколько зараженных устройств... до четырех таких промежуточных звеньев.

“Manic simply stores the stolen data on the device and starts scanning nearby for other infected phones it can reach over Wi-Fi or Bluetooth ... Data can hop across a chain of infected devices. By default, Manic allows up to four of these relay devices in the chain.”

A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable.

“Using Accessibility services once again, it also lets attackers take remote control of an infected device.”

если зараженный смартфон не имеет доступа к интернету, украденные данные передаются на управляющий сервер через другие устройства поблизости при помощи Wi‑Fi Direct, Bluetooth или BLE.