Android trojan Manic steals PINs without a fake banking screen

Dutch security firm ThreatFabric published a report on 20 August on a previously undocumented Android threat. It calls the malware Manic, and it blends two things that usually stay apart: a banking trojan built to take money, and spyware built to watch the owner. The campaign is aimed mainly at Ukraine. The target list also covers banks in Germany, Poland, the Czech Republic, Slovakia, Austria, France, Spain, the Netherlands, Estonia, Lithuania and the United Kingdom, plus state eID apps in several of those countries.

In total Manic watches 169 package IDs, the technical identifiers of individual apps. The list spans banks, payment services, buy now pay later, remittances, crypto exchanges and wallets, messengers, browsers, email clients, government eID apps and authenticator apps, which are the ones that generate the second factor at login. ThreatFabric traces the first infrastructure back to February 2026. A reworked build arrived in July with stronger anti-analysis checks.

The PIN travels along, and no fake bank screen appears

A classic banking trojan paints a copied bank interface over the real app. Look closely enough and you can spot it. Manic works differently. When it finds a numeric keypad inside a target app, it lays a transparent surface exactly over those keys. As the user taps, Manic records the position, briefly switches off its own touch interception, and replays the tap at the same spot through Android's accessibility services. The banking app receives the input as normal and carries on. Nothing on screen looks wrong. The PIN still ends up with the attacker. The pattern turns up in other scams as well, where the attack targets precisely the signal people rely on to notice that something is off.

A second function, which ThreatFabric calls autoEnterPin, works at the lock screen and tries to enter a previously captured PIN or pattern by itself. The accessibility services double as a keylogger. Manic sorts captured input in advance by whether it looks like a lock screen entry, a recovery phrase for a crypto wallet, a four to six digit SMS code, or a password.

A second infected phone as the way out

The most unusual part is how the data leaves. If an infected device cannot reach the attackers' server, Manic encrypts what it collected and puts it in a queue. It then looks for another infected phone within radio range over Wi-Fi Direct, Bluetooth or Bluetooth Low Energy and checks whether that one is online. If it finds one, the package moves there and onward to the server. Up to four relay hops are configured by default.

In practice that means taking a phone off the network does not necessarily stop the leak, as long as a second infected device is lying nearby. It is the same thinking error as with two-factor sign-in, where a stolen session cookie makes the second factor pointless.

How to spot it

Manic comes in two parts, a wrapper that gets it onto the device and the implant itself. The package names are picked to sound like system components from well known vendors. ThreatFabric lists tech.intel.dialer.updater, org.honor.secure.helper, org.lenovo.storage.processor, dev.huawei.media.helper, tech.apple.dialer.scheduler and io.motorola.secure.executor. The July build removes its icon from the app drawer, so it no longer shows up in the menu at all.

Everything hangs on two permissions, accessibility services and notification access. To check whether something is wrong, open the accessibility section in Android settings and look at the services listed there. Anything that does not clearly belong to a helper app you installed on purpose should be switched off. The same goes for notification access. Manic also tries to disable Google Play Protect through automated taps, so the Play Store is worth a look as well.

ThreatFabric does not say how many devices are affected, and there are no infection figures for any single country. The simplest protection is still the old one. Do not install APK files from links or third party portals, not even when the page looks like a well known vendor.