Manic Android Trojan Relays Stolen Banking Data Through Nearby Devices

Researchers identified Manic, an Android malware family combining banking-trojan, spyware, and remote-access functions. It abuses Accessibility services, a transparent keyboard overlay, SMS access, and notification access to capture credentials, banking details, and one-time authentication codes; it can also conceal operator activity with a black screen or fake system-update display while performing actions on the victim device.

Manic’s distinguishing capability is mesh-style data exfiltration: offline infected phones can encrypt and relay stolen data over Wi-Fi or Bluetooth through as many as four nearby compromised devices until a node reaches the internet. Infrastructure linked to the campaign reportedly appeared in February 2026 and samples were identified in late May, with banking-app users in multiple European countries, including Russia, Ukraine, and the United Kingdom, among the targets.