Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions.
After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions.
ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally.
“Manic uses its Accessibility service as a UI keylogger,” ThreatFabric explains, adding that the malware “classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.”
ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally.
“Manic uses its Accessibility service as a UI keylogger,” ThreatFabric explains, adding that the malware “classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.”
The malware authors implemented an unusual data exfiltration mechanism that kicks in when a compromised device cannot reach the command-and-control (C2) server. The researchers say that the data is encrypted and transferred via nearby compromised devices over Wi-Fi Direct or Bluetooth connections.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware that combines spyware, banking fraud, and remote control functions. It abuses Accessibility and notification permissions to capture lock PINs/passwords, intercept SMS and notifications, collect files and location data, monitor the screen, and enable operator remote control via WebRTC. It also uses transparent overlays to capture keypad taps and has a fallback exfiltration mechanism that relays encrypted data through nearby infected devices over Wi-Fi Direct or Bluetooth, including multi-hop routing.
An Android malware family that blends banking-malware functionality with spyware capabilities, enabling financial fraud as well as surveillance and device control.
Android malware family focused primarily on Ukraine that combines banking fraud, credential and authentication theft, surveillance, device takeover, remote control via WebRTC, PIN/keypad interception, notification/SMS harvesting, and an unusual Wi‑Fi Direct/Bluetooth mesh relay for exfiltration through nearby infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.