Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
Manic Android malware uses Wi-Fi mesh to exfiltrate data from offline phones via infected devices.
A new Android malware named Manic targets financial, government, and messaging apps in Ukraine, Russia, and Europe. It combines banking fraud and spyware capabilities, uniquely using a Wi-Fi mesh technique to relay data from offline devices through nearby infected ones with internet access. Manic is distributed via phishing sites and dropper apps, and its development dates back to February 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Manic malware represents a significant escalation in mobile threat sophistication by leveraging a Wi-Fi mesh relay technique that bypasses the assumption that offline devices are safe from data exfiltration. Distributed through phishing sites and malicious dropper apps, it exploits users' lack of awareness around app sourcing and permission grants to establish a covert spyware and banking fraud foothold. What makes this particularly dangerous is that simply taking a device offline is no longer a sufficient defensive measure, as nearby compromised devices can act as unwitting data relays. This undermines traditional air-gap assumptions and highlights the critical need for layered mobile security controls beyond basic network isolation.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Manic