Researchers report a real Android malware operation (“Manic”) active since at least February 2026 that blends banking fraud with spyware-style surveillance. It can trick users into revealing their device PIN/pattern via a fake lock prompt and silently capture banking PIN taps, then exfiltrate stolen data even while the victim phone is offline by relaying it through nearby infected devices over Bluetooth or Wi‑Fi Direct.
Manic is an Android malware operation that researchers have tracked since at least February 2026, still under active development as of July. It targets a broad set of 169 apps spanning banking, government eID services, crypto, 2FA tools, messaging, browsers, and email clients, with particular focus on users in Ukraine. The malware combines banking fraud techniques with spyware-style surveillance in a single package.
A core technique is lock-secret phishing: a fake prompt appears before the victim reaches the real Android lock screen, tricking them into typing their device PIN or unlock pattern directly into attacker-controlled input. Separately, when Manic detects a numeric keypad inside a targeted banking or payment app, it overlays an invisible layer on the keys, records each tap, then relays the tap through Android's Accessibility service to the real keypad so the app continues functioning normally while the PIN is captured in the background.
The attack relies on Android's Accessibility and notification permissions, which Manic requests after installation and then uses as a UI keylogger to intercept passwords and SMS codes. Because the fake lock prompt and invisible keypad overlay are designed to look and behave like normal device functions, most users have no visible cue that anything is wrong. The malware also hides activity with black screens, fake screens, or fake update messages, which conceals both its background actions and any permission requests from the user.
Manic can exfiltrate stolen data even when a phone is offline, using a store-and-forward relay that moves encrypted data through nearby infected devices over Bluetooth, Wi-Fi Direct, or BLE, up to four hops. This means being offline does not guarantee safety. Defenders and users should treat any lock-screen prompt that appears before the expected lock screen as suspicious, restart the device, and report it. Organizations should scrutinize Accessibility permission requests closely, since this permission underpins both the keylogging and remote control capabilities described in this case. Monitoring for unusual Accessibility grants and unexpected Bluetooth or Wi-Fi Direct connections from phones not actively transferring files offers a practical starting point for detection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Manic is an Android malware operation active since at least February 2026 that combines banking fraud with spyware-style surveillance, targeting 169 apps including banking, government eID, crypto, and messaging apps, with a focus on Ukraine.
It uses a technique called lock-secret phishing, showing a fake prompt before the victim reaches the real lock screen to capture the PIN or pattern.
Yes, it uses a store-and-forward relay mechanism, sending encrypted data through nearby infected devices over Bluetooth or Wi-Fi Direct, up to four hops, when it cannot reach its server directly.
When it detects a numeric keypad in a targeted app, it places an invisible layer over the keys, records each tap, then passes the tap to the real keypad using Android's Accessibility features so the app appears to work normally.
Imagine this: your Android suddenly asks for your PIN, then a second lock screen appears right after. That’s how the Manic malware does “lock-secret phishing” on Android: it shows a fake PIN prompt before the real lock screen, grabs your device PIN or pattern, then quietly keylogs banking PINs using Accessibility while the app looks totally normal. Here’s the creepy part: Manic can still smuggle your PINs out while your phone is offline, hopping encrypted data through nearby infected phones over Bluetooth or Wi‑Fi Direct, up to four devices away. If you ever see a PIN prompt pop up at a weird time or twice in a row, stop. Don’t enter it, restart your phone, then report it to IT or Security.
Researchers investigated a fake Android app posing as a Chinese public security bureau service and traced it to a broader criminal ecosystem using a leaked Android remote-access tool (RAT) framework called “Flying Eagle.” The tooling lets criminals build convincing look‑alike apps and then steal…
A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure),…
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
