New Manic Android malware can exfiltrate data through nearby devices

A new Android malware named Manic targeting users in multiple European countries has a fallback mechanism for exfiltrating data through nearby infected devices.

The malware has been active since at least February and combines spyware, banking fraud, and remote control capabilities.

It targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps, with users in Ukraine being the primary focus.

Mobile security company ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally.

After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions.

The captured information is categorized by type, making the data more readily exploitable for the malware operators.

“Manic uses its Accessibility service as a UI keylogger,” ThreatFabric explains, adding that the malware “classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.”

Manic malware authors implemented an unusual data exfiltration mechanism that kicks in when a compromised device cannot reach the command-and-control (C2) server.

The researchers say that the data is encrypted and transferred via nearby compromised devices over Wi-Fi Direct or Bluetooth connections.

"Manic first attempts to use an established Wi-Fi Direct peer, then queries Bluetooth and BLE peers to determine whether they have internet connectivity," ThreatFabric says.

"If necessary, the malware can also use multi-hop routes, with newly queued items configured for a maximum of four relay hops by default."

This mechanism also allows data exfiltration even from offline devices, as long as another infected device is within WiFi or Bluetooth range.

ThreatFabric says the malware targets applications used across Central and Western Europe, including the U.K., as well as Russia. However, its primary focus appears to be banking and government/eID applications in Ukraine, along with global fintech and cryptocurrency services.

Although the exact infection vector remains unknown, the researchers noticed in late May the use of a wrapper that delivered the main payload to victims, followed by an expansion of the existing infrastructure in the months that followed.

In July, an updated wrapper with stronger anti-analysis checks and in-memory DEX loading was observed in attacks, and a new panel and API also rolled out.

Android users are advised to avoid downloading APKs from obscure sources and unofficial portals, deny Accessibility permissions unless required by a trusted application, and regularly run Play Protect scans to detect and remove known malware.

Update 22/8 - Google sent the following statement about Manic malware: 

“Based on our current detection, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services." - A Google spokesperson