Loading story…
Researchers identified Manic, an Android malware family combining banking-trojan, spyware, and remote-access functions. It abuses Accessibility services, a transparent keyboard overlay, SMS access, and notification access to capture credentials, banking details, and one-time authentication codes; it can also conceal operator activity with a black screen or fake system-update display while performing actions on the victim device.
Manic’s distinguishing capability is mesh-style data exfiltration: offline infected phones can encrypt and relay stolen data over Wi-Fi or Bluetooth through as many as four nearby compromised devices until a node reaches the internet. Infrastructure linked to the campaign reportedly appeared in February 2026 and samples were identified in late May, with banking-app users in multiple European countries, including Russia, Ukraine, and the United Kingdom, among the targets.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
The earliest identified samples of the Manic Android banking trojan, spyware, and remote-access malware family appeared in late May 2026.
Researchers traced the attacker infrastructure supporting the Manic Android malware campaign to February 2026.
After the earliest samples emerged, Manic's operators improved the malware's mechanisms for evading detection on infected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ThreatFabric researchers reported a new Android malware strain, **Manic**, that is being actively distributed in the wild and primarily targets users in Ukraine while also reaching victims across Europe and beyond. The malware combines mobile banking trojan behavior with spyware and remote-control functions, targeting at least **169 applications** tied to banks, government and eID services, payment platforms, cryptocurrency wallets, messaging tools, authenticator apps, and military-focused communications. Reported targets include Ukrainian banks and state services, as well as Russian and European financial institutions and global fintech and crypto services. Manic abuses Android **Accessibility** services and uses transparent keypad overlays to capture credentials and user input while legitimate apps continue to operate, enabling theft of PINs, passwords, SMS codes, and other sensitive data. Researchers said the malware also features an unusual fallback exfiltration method that sends encrypted stolen data through nearby infected devices over **Wi-Fi Direct** or **Bluetooth**, including multi-hop routing when a device lacks direct internet access. The campaign has reportedly been active since at least February, with wrapper-based payload delivery observed in late May and more advanced anti-analysis and in-memory DEX loading added in July.
Aug 21, 2026
Researchers documented multiple evolutions of the **BianLian** Android banking trojan, showing a malware family that abuses **Accessibility Services** to seize control of infected devices, hide its launcher icon, deploy overlay attacks, intercept SMS, execute USSD commands, lock screens, and target banking and cryptocurrency users. Fortinet reported a heavily obfuscated variant that dynamically loads a secondary APK downloaded from command-and-control infrastructure rather than decrypting it from app assets, and noted that the payload checks whether **Google Play Protect** is enabled through the **SafetyNet API**. Later analysis of a newer sample found BianLian continuing to broaden both its infrastructure and victim scope, using a **Tor onion service** to deliver a Base64-encoded JSON configuration containing multiple C2 domains and targeting **438 mobile applications**, primarily banking apps. The malware also added or refined remote-access capabilities including **screen recording** via `MediaProjection` and a **SOCKS5/SSH proxy** with remote port forwarding, while reorganizing code to improve persistence and evasion on major Android vendors by handling battery optimizations, disabling Huawei and Samsung protections, and enabling autostart on Xiaomi MIUI devices.
Aug 15, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026