Manic Android Malware Exfiltrates Data From Offline Devices via Nearby Infected Phones — Detection and Defense Guide

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, alongside Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications platforms. What makes Manic operationally significant is not just its target list — it is the claim, now observed in the wild, that the malware can exfiltrate data from devices that appear to be offline by relaying through nearby infected devices.

Manic sits at the intersection of Android banking malware and mobile spyware: it combines financial fraud capability (credential theft, overlay/Accessibility abuse against banking apps) with surveillance-grade collection (messages, identity documents, MFA codes) and a peer-to-peer exfiltration model that defeats the "airplane mode is safe" assumption many high-risk users and organizations still rely on.

If you operate in financial services, government, defense-adjacent sectors, or support users in Eastern Europe, this is a threat to track now. This post breaks down the attack model, what defenders can actually observe, and concrete hunting and hardening guidance.

Technical Analysis

What Manic Is

Based on the reporting, Manic blends three functional layers:

1. Banking trojan capabilities — targeting banking, fintech, and cryptocurrency applications for credential theft, session hijacking, and transaction fraud. This almost certainly involves the standard Android banker tradecraft: Accessibility Service abuse (to read screen content, intercept credentials, perform gesture injection, and self-grant permissions), overlay injection against targeted bank apps, and SMS interception for OTP/2FA theft.

2. Spyware capabilities — collection against messaging applications, government identity services, and military-focused communications. That implies access to notifications, messages, contacts, files, and possibly microphone/camera or location — the classic mobile surveillance toolkit.

3. Mesh/proximity exfiltration — the headline capability. An infected device that is offline (no cellular/Wi-Fi internet path) can hand stolen data to a nearby infected peer device over a short-range radio channel, and the peer relays it onward to attacker infrastructure when it has connectivity.

Why the "Offline Exfiltration" Matters

Most mobile data theft assumes a live internet path from the victim device. Defenders and high-risk users have internalized a simple mitigation: if the device is offline, it can't leak. Manic breaks that assumption by implementing a store-and-forward relay across infected peers. Conceptually, this is a mobile botnet behavior we have previously seen only in research and nation-state tooling — the idea that a compromised handset in a sensitive facility can pass data to another compromised handset in the parking lot, which then uploads it over its own LTE connection.

The practical radio channels for this on Android are limited and therefore detectable:

• Bluetooth / Bluetooth Low Energy (BLE) — classic for short-range peer discovery and transfer; requires Bluetooth permissions and, on modern Android, BLUETOOTH_SCAN/BLUETOOTH_CONNECT (runtime permissions since Android 12).
• Wi-Fi Direct (Wi-Fi P2P) — higher bandwidth peer-to-peer transfer without an access point; uses the WifiP2pManager API and requires location-adjacent permissions on recent Android versions.
• Nearby Connections / Google Nearby APIs — an abstraction over BLE/Wi-Fi Direct that malware can abuse to avoid low-level radio handling.

The key defensive insight: an app that is both (a) stealing banking/identity data and (b) constantly scanning/advertising for nearby peers is behaviorally loud if you are collecting the right telemetry.

Targeting and Victimology

Per the reporting, observed targeting spans:

• Ukrainian banks, government and identity services, messaging applications, and military-focused communications — consistent with the well-documented pattern of Russia-aligned mobile operations against Ukrainian military and government users (the same operational theater that produced campaigns like Infamous Chisel/Sandworm's Android collection against the Ukrainian military).
• Russian and European financial institutions — suggesting either financially motivated operators, dual-use tooling, or collection against Russian domestic users by Ukrainian-aligned actors. Defenders should not assume attribution from targeting alone; mobile tooling is frequently shared, sold, or repurposed.
• Global fintech and cryptocurrency services — the standard expansion path for any successful banking trojan family, driven by the value of wallet keys and exchange sessions.

Exploitation Status

This is confirmed active, in-the-wild malicious activity — a live malware campaign, not a theoretical technique. There is no CVE associated with this threat in the reporting; Manic does not appear to require a platform exploit to operate. Like most Android bankers, it almost certainly relies on social engineering for installation (smishing links, trojanized apps, fake bank/government apps, droppers that evade Play Protect) followed by Accessibility permission abuse to elevate its capabilities. That makes the delivery and permission-grant stage the highest-value place to detect and block it.

Affected Platforms

• Android devices across the ecosystem; users sideloading apps or installing APKs from links are at highest risk.
• Organizations with BYOD programs where corporate email, SSO, or banking access coexists with unvetted personal apps.
• High-risk user populations (government, military, finance, crypto) whose threat model previously assumed offline devices were safe from exfiltration.

Detection & Response

What You Can Actually Observe

Manic's defining behaviors map to observable telemetry:

• Accessibility Service abuse — a non-system, user-installed package holding Accessibility permission is one of the highest-signal mobile IOCs available. Legitimate apps that need Accessibility are rare (password managers, authenticators, some enterprise agents).
• Proximity radio abuse — a user-installed app holding Bluetooth scan/connect and/or Wi-Fi Direct-related permissions, especially combined with Accessibility or SMS permissions, is anomalous.
• Overlay/screen-read behavior — Accessibility events targeting known banking, messaging, and identity package names.
• Installation from outside Play Store — sideloaded APKs via package installer with INSTALL_PACKAGES or browser-driven installs.
• Mesh relay traffic — a device making BLE advertisements/scans or Wi-Fi Direct group formation while ostensibly "offline" (airplane mode with Bluetooth re-enabled, or Wi-Fi Direct active without an AP connection).

The Sigma rules below target host/network telemetry where Android activity surfaces in enterprise environments (e.g., Android devices enrolled in MDM sending logs, or workstations used to sideload APKs via ADB). The KQL and VQL content focuses on hunting the endpoint and network behaviors that betray this class of malware.

Sigma Rules

---
title: Sideloaded APK Installation or ADB Package Install Activity
id: 3f6b9a2c-1d4e-4c8a-9b2f-7a1e5d6c8f90
status: experimental
description: Detects installation of Android packages outside the Play Store or via ADB, a common delivery mechanism for Android banking trojans and spyware such as Manic. Focus on environments where mobile devices are managed or where workstations are used to sideload apps.
references:
  - https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
  - https://attack.mitre.org/techniques/T1476/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.execution
  - attack.t1476
logsource:
  category: process_creation
  product: windows
detection:
  selection_adb_install:
    Image|endswith: '\\adb.exe'
    CommandLine|contains:
      - ' install '
      - 'install-multiple'
      - ' pm install'
  selection_adb_path:
    CommandLine|contains:
      - '.apk'
  condition: selection_adb_install and selection_adb_path
falsepositives:
  - Legitimate mobile development and QA activity
  - Enterprise device provisioning workflows
level: medium
---
title: Android Accessibility Service Granted to Non-System Package
id: 8a2c4d6e-9f1b-4a7c-b3d5-2e6f8a0c1d3e
status: experimental
description: Detects Android audit/MDM telemetry indicating a user-installed (non-system) package has been granted Accessibility Service permission. Accessibility abuse is the primary privilege-escalation and credential-theft mechanism for Android banking trojans such as Manic, which target banking, identity, and messaging apps.
references:
  - https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
  - https://attack.mitre.org/techniques/T1517/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.privilege_escalation
  - attack.credential_access
  - attack.t1517
logsource:
  category: process_creation
  product: android
detection:
  selection_accessibility:
    - EventMessage|contains:
        - 'AccessibilityService'
        - 'accessibility_enabled'
        - 'enabled_accessibility_services'
    - CommandLine|contains:
        - 'settings put secure enabled_accessibility_services'
  filter_system:
    PackageName|startswith:
      - 'com.android.'
      - 'com.google.android.'
      - 'com.samsung.'
      - 'com.miui.'
  condition: selection_accessibility and not filter_system
falsepositives:
  - Legitimate password managers and authenticator apps that request Accessibility
  - Enterprise MDM agents with documented Accessibility use
level: high
---
title: Proximity Radio and Data-Collection Permission Combination on Android
id: 5d7e9f1a-2b3c-4d5e-8f6a-1b2c3d4e5f6a
status: experimental
description: Detects MDM/audit telemetry showing a user-installed Android app holding both proximity-radio permissions (Bluetooth scan/connect, Wi-Fi Direct/Nearby) and sensitive data permissions (Accessibility, SMS, notifications). This combination matches the peer-to-peer offline exfiltration model attributed to the Manic Android malware.
references:
  - https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
  - https://attack.mitre.org/techniques/T1011/
  - https://attack.mitre.org/techniques/T1430/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1011
  - attack.t1430
logsource:
  category: process_creation
  product: android
detection:
  selection_proximity:
    GrantedPermissions|contains:
      - 'BLUETOOTH_SCAN'
      - 'BLUETOOTH_CONNECT'
      - 'NEARBY_WIFI_DEVICES'
  selection_sensitive:
    GrantedPermissions|contains:
      - 'BIND_ACCESSIBILITY_SERVICE'
      - 'READ_SMS'
      - 'RECEIVE_SMS'
      - 'BIND_NOTIFICATION_LISTENER_SERVICE'
      - 'READ_CONTACTS'
  condition: selection_proximity and selection_sensitive
falsepositives:
  - Legitimate companion apps for wearables that also read notifications
  - Contact-tracing or enterprise proximity apps in documented use
level: high

KQL — Microsoft Sentinel / Defender

This query hunts Android devices (via Defender for Endpoint mobile telemetry ingested into Sentinel/Defender) that have been granted Accessibility plus proximity-radio permissions — the signature combination for a banker/spyware hybrid with peer-to-peer exfiltration like Manic. It also includes a network hunt for mobile devices initiating unusual outbound connections after being offline.

// Hunt: Android apps with Accessibility + proximity-radio permission combination
// Tables: DeviceInfo / DeviceEvents (Defender for Endpoint mobile), or MDM-ingested custom logs
// Tune the package allowlist to your environment's legitimate Accessibility apps.
let LegitAccessibilityApps = dynamic([
  "com.google.android.marvin.talkback",
  "com.microsoft.windowsintune.companyportal"
]);
DeviceEvents
| where Timestamp > ago(14d)
| where DeviceType has "Android" or AdditionalFields has "Android"
| extend AF = AdditionalFields
| where tostring(AF) has_any ("Accessibility", "BLUETOOTH_SCAN", "NEARBY_WIFI_DEVICES", "enabled_accessibility_services")
| extend PackageName = tostring(parse_json(AF).PackageName),
         Permissions = tostring(parse_json(AF).Permissions)
| where PackageName !in~ (LegitAccessibilityApps)
| where Permissions has_any ("BLUETOOTH_SCAN", "BLUETOOTH_CONNECT", "NEARBY_WIFI_DEVICES")
   and (Permissions has "Accessibility" or tostring(AF) has "enabled_accessibility_services")
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Events = count()
  by DeviceName, DeviceId, PackageName, Permissions
| order by Events desc;

// Hunt: Mobile devices making outbound connections after a connectivity gap
// Use to find store-and-forward relay behavior (offline device that later bursts data)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DeviceType has "Android"
| summarize ConnCount = count(), DistinctRemoteIPs = dcount(RemoteIP), FirstConn = min(Timestamp), LastConn = max(Timestamp)
  by DeviceName, bin(Timestamp, 1h)
| where ConnCount > 200 and DistinctRemoteIPs > 20
| order by ConnCount desc;

Velociraptor VQL

This artifact hunts Windows endpoints for ADB usage against Android devices — relevant in DFIR when you suspect a workstation was used to sideload a malicious APK or pull data from a device. It also enumerates recently created .apk artifacts in common staging paths.

-- Hunt for ADB execution and staged APK files on endpoints
-- Relevant when investigating sideloaded Android malware (e.g., Manic) delivered via workstation

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)adb\.exe$'
   AND CommandLine =~ '(?i)(install|install-multiple|push|shell\s+pm\s+install)'

-- Also enumerate recently modified APK files in common staging locations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(
  globs=[
    'C:/Users/*/Downloads/*.apk',
    'C:/Users/*/Desktop/*.apk',
    'C:/Users/*/Documents/*.apk',
    'C:/Temp/*.apk'
  ]
)
WHERE Mtime > now() - 1209600  -- last 14 days
ORDER BY Mtime DESC

Containment & Triage Script

This Bash script uses adb to audit a connected Android device for the highest-signal Manic indicators: sideloaded packages, non-system Accessibility services, and apps holding the dangerous permission combinations (Accessibility/SMS + Bluetooth/Nearby). Run it against any device under investigation.

#!/usr/bin/env bash
# audit_android_manic.sh — triage a connected Android device for Manic-class indicators
# Requires: adb in PATH, device with USB debugging authorized
set -euo pipefail

echo "[+] Device: $(adb shell getprop ro.product.model | tr -d '\r')  Android $(adb shell getprop ro.build.version.release | tr -d '\r')"

echo -e "\n[1] Non-system (third-party) packages installed:"
adb shell pm list packages -3 | sed 's/package://' | tr -d '\r'

echo -e "\n[2] Enabled Accessibility services (non-Google/OEM are suspicious):"
adb shell settings get secure enabled_accessibility_services | tr -d '\r'

echo -e "\n[3] Apps holding dangerous permission combos (Accessibility/SMS + Bluetooth/Nearby):"
for pkg in $(adb shell pm list packages -3 | sed 's/package://' | tr -d '\r'); do
  perms=$(adb shell dumpsys package "$pkg" 2>/dev/null | grep -E 'android.permission.(BIND_ACCESSIBILITY_SERVICE|READ_SMS|RECEIVE_SMS|BLUETOOTH_SCAN|BLUETOOTH_CONNECT|NEARBY_WIFI_DEVICES|BIND_NOTIFICATION_LISTENER_SERVICE)' | tr -d '\r' || true)
  if echo "$perms" | grep -qE 'ACCESSIBILITY|SMS|NOTIFICATION' && echo "$perms" | grep -qE 'BLUETOOTH|NEARBY'; then
    echo "  !! HIGH-RISK COMBO: $pkg"
    echo "$perms" | sed 's/^/       /'
  fi
done

echo -e "\n[4] Apps that can install other packages (droppers):"
adb shell appops get --op REQUEST_INSTALL_PACKAGES 2>/dev/null | grep -E 'allow|MODE' || echo "  (query manually: adb shell cmd appops query-op REQUEST_INSTALL_PACKAGES)"

echo -e "\n[5] Bluetooth & Wi-Fi Direct state:"
adb shell dumpsys bluetooth_manager | grep -E 'enabled|state' | head -n 5
echo "  Wi-Fi P2P:"
adb shell dumpsys wifip2p 2>/dev/null | grep -E 'mNetworkInfo|group' | head -n 5 || true

echo -e "\n[+] Triage complete. Quarantine any high-risk package: adb shell pm uninstall --user 0 <package>"

Remediation & Hardening

There is no vendor patch for Manic — it is a malware campaign, not a platform vulnerability. Remediation is about removing infections, closing the delivery and privilege paths it abuses, and shrinking the proximity-exfiltration attack surface.

For Infected or Suspected Devices

1. Isolate and preserve. Do not simply factory-reset a device involved in a potential incident if it may hold evidence. Capture device logs, installed package list, and Accessibility settings (the audit script above) before remediation.
2. Remove the malware. Uninstall the malicious package (adb shell pm uninstall --user 0 <package>). Revoke its Accessibility and device-admin privileges first if it resists removal. For persistent infections, a full factory reset with a verified clean OS image is the reliable path.
3. Rotate everything it could touch. Manic targets banking credentials, identity services, messaging, and crypto. Reset banking/fintech/email passwords, revoke active sessions, rotate MFA seeds/devices, and for any crypto wallets accessible on the device, move funds to new keys — assume wallet files and seed material are compromised.
4. Check the peers. Given the peer-relay model, if one device in a team, household, or unit is infected, audit physically co-located devices — they may have served as relays or been infected as secondary targets.

For Organizations

1. Block sideloading on managed devices. Enforce via MDM: disable installation from unknown sources, restrict ADB/USB debugging, and require Play Integrity / Play Protect attestation. This kills the most common Manic delivery path.
2. Alert on Accessibility grants. Treat any non-allowlisted app receiving Accessibility permission on a corporate or BYOD device as a high-severity alert. Maintain a strict allowlist (authenticators, password managers, MDM agents) and auto-flag everything else.
3. Restrict dangerous permission combinations. Use app-vetting (mobile threat defense, or MDM app config) to flag/block apps requesting Accessibility/SMS/notification access combined with Bluetooth scan/connect or Nearby/Wi-Fi Direct permissions.
4. Enforce radio policy in sensitive areas. The offline-exfiltration model specifically abuses the fact that "airplane mode" often leaves Bluetooth re-enabled or easily re-enabled. For high-risk facilities and personnel, policy should disable Bluetooth and Wi-Fi Direct — not just cellular/Wi-Fi — and MDM should enforce it.
5. Protect the high-risk apps. Enable app-level protections on banking, identity, and messaging apps: strong phishing-resistant MFA (passkeys/hardware keys over SMS OTP), transaction signing, and device binding — all of which raise the cost of Manic's credential theft.
6. User guidance for targeted populations. For government, military, and finance users in the affected regions: install apps only from official stores, never from links in SMS/messaging apps; treat unexpected Accessibility permission prompts as a red flag; and report any app that requests permissions inconsistent with its function.

Threat-Informed Posture

Because Manic targets Ukrainian government, military, and financial users as well as European and global fintech, organizations in those sectors should treat this as a priority threat-hunt scenario, not a generic mobile hygiene item. Fold the permission-combination and Accessibility-abuse detections above into your mobile telemetry pipeline now, and brief high-risk users on the delivery lure (fake bank/government apps, smishing) that starts the chain.

Bottom Line

Manic is a reminder that mobile malware has matured past the simple banking trojan. The combination of financial fraud, spyware-grade collection, and peer-to-peer exfiltration that defeats "offline" assumptions makes it a genuine operational threat — especially for the Ukrainian government/military and global financial targets named in this campaign. The defensive leverage points are clear: control app installation, alarm on Accessibility abuse, police the proximity-radio permission surface, and harden the high-value apps with phishing-resistant auth. The detections and audit tooling above give you a concrete starting point.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub