Loading story…
ThreatFabric researchers reported a new Android malware strain, Manic, that is being actively distributed in the wild and primarily targets users in Ukraine while also reaching victims across Europe and beyond. The malware combines mobile banking trojan behavior with spyware and remote-control functions, targeting at least 169 applications tied to banks, government and eID services, payment platforms, cryptocurrency wallets, messaging tools, authenticator apps, and military-focused communications. Reported targets include Ukrainian banks and state services, as well as Russian and European financial institutions and global fintech and crypto services.
Manic abuses Android Accessibility services and uses transparent keypad overlays to capture credentials and user input while legitimate apps continue to operate, enabling theft of PINs, passwords, SMS codes, and other sensitive data. Researchers said the malware also features an unusual fallback exfiltration method that sends encrypted stolen data through nearby infected devices over Wi-Fi Direct or Bluetooth, including multi-hop routing when a device lacks direct internet access. The campaign has reportedly been active since at least February, with wrapper-based payload delivery observed in late May and more advanced anti-analysis and in-memory DEX loading added in July.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
After initial Manic efforts were abandoned from late June to mid-July 2026, signs of a second deployment emerged around July 13. This newer iteration included stronger anti-analysis features and lock-screen secret phishing capabilities.
In July, researchers observed an updated Manic wrapper that added stronger anti-analysis checks and in-memory DEX loading. They also saw a new operator panel and API associated with the campaign.
Researchers observed a wrapper delivering the main Manic payload to victims in late May. They also noted subsequent expansion of the malware's supporting infrastructure after this delivery stage was seen.
ThreatFabric researchers observed the Android malware family Manic operating in the wild since at least February. The malware combines banking-fraud, spyware, and remote-control capabilities and primarily targets users in Ukraine while also reaching other European countries and Russia.
ThreatFabric identified Manic as a new Android threat and reported that it targets at least 169 banking, government/eID, payment, cryptocurrency, messaging, and authenticator applications. The analysis highlighted its blend of banking malware and spyware behavior, including a relay-based fallback exfiltration mechanism using nearby infected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcethreatfabric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Manic**, an Android malware family combining banking-trojan, spyware, and remote-access functions. It abuses Accessibility services, a transparent keyboard overlay, SMS access, and notification access to capture credentials, banking details, and one-time authentication codes; it can also conceal operator activity with a black screen or fake system-update display while performing actions on the victim device. Manic’s distinguishing capability is mesh-style data exfiltration: offline infected phones can encrypt and relay stolen data over Wi-Fi or Bluetooth through as many as four nearby compromised devices until a node reaches the internet. Infrastructure linked to the campaign reportedly appeared in February 2026 and samples were identified in late May, with banking-app users in multiple European countries, including Russia, Ukraine, and the United Kingdom, among the targets.
Aug 31, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Researchers reported that **ToxicPanda 2.0** has significantly expanded its Android banking trojan capabilities, targeting more than **140 banking and cryptocurrency apps** and using overlay attacks against **349 financial institutions in 16 countries**. The updated malware is designed to steal credentials and PINs, including device lock credentials, by presenting fraudulent screens over legitimate apps and harvesting sensitive input from victims. The malware also deepens persistence by abusing **Android Accessibility Service** to enable **wireless debugging**, interact with consent prompts, and gain shell-level access through the **Android Debug Bridge (ADB)** daemon. That combination allows attackers to grant broad permissions and maintain access to compromised devices even after initial infection, prompting defenders to prioritize controls such as blocking sideloading on managed devices, treating accessibility grants as privileged events, and alerting on developer options or wireless debugging being enabled.
Aug 28, 2026