Malware News New Android malware blurs the line between banking trojan and spyware

[Brownie2019]

Content source

https://cybernews.com/news/new-android-malware/

Key takeaways:

• Manic targets 169 apps, including banks, crypto wallets, messaging apps, government services and email clients.
• The malware can steal passwords, one-time codes and recovery phrases after gaining device permissions.
• Manic can send stolen data through nearby infected phones using WiFi Direct or Bluetooth.
• Researchers say Android users should avoid sideloading apps from unreliable sources.

Security researchers have identified new Android malware capable of sending stolen data via infected phones back to the scammers.

The newly identified Android malware is dubbed Manic and features some particularly dangerous capabilities.

“Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features,” ThreatFabric’s Mobile Threat Intelligence (MTI) team says in an analysis.

Manic monitors a total of 169 different apps, including banks, payment services, cryptocurrency wallets and exchanges, messaging apps, government services, authenticator apps, browsers, and email clients.
The Android malware’s primary targets are located in Ukraine. However, Manic also extends its focus to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.

How does it work? According to ThreatFabric, Manic integrates multiple functions into a comprehensive fraud workflow, progressively giving attackers nearly full control over an infected device.

After obtaining Accessibility and notification access, the malware can:

Capture the victim’s PIN, password, pattern, fingerprint, or facial recognition to unlock a device.
Steal sensitive information such as passwords, one-time codes, and recovery phrases.
Use overlays or fake screens in banking and crypto apps to hide malicious activities and intercept keypad inputs.
Eavesdrop on a target’s communication by accessing text messages.
Watch the screen and interact with the device remotely by abusing Accessibility Services privileges.
All without the victims noticing anything.

The collected data and files are encrypted with AES-GCM and placed in a local queue, as the malware is looking for a route to the attacker’s Command and Control (C2) infrastructure.
A unique feature of the Manic malware is that it can send stolen data to nearby infected devices via WiFi Direct or Bluetooth. This could come in handy if the source device has no internet connection. If no route is available, the data package remains queued, and Manic tries again later.

“As a result, removing direct internet access from an infected device does not necessarily prevent data exfiltration, as another infected phone within radio range may act as its gateway,” researchers explain.

Manic is nowhere to be found in the Google Play Store. Therefore, Android users should exercise caution when sideloading APKs or apps from unreliable sources online.

 

[Bot]

Practical advice for Android users

The described capabilities would require powerful permissions, especially Accessibility Services, notification access, SMS access, and permission to install or display content over other apps. These permissions should not be granted casually, particularly to APKs installed outside Google Play.

Recommended precautions:

• Avoid sideloading APKs from advertisements, unofficial stores, messaging groups, or file-sharing links.
• Keep Android and Google Play system updates current.
• Review Settings → Accessibility, Notification access, Device admin apps, Install unknown apps, and Display over other apps. Disable access that is not required.
• Run a scan with reputable, up-to-date mobile security software. A scan cannot guarantee detection, so it should be combined with permission and account review.
• If compromise is suspected, use a different trusted device to change important passwords, revoke active sessions, replace exposed recovery codes, and contact banks or exchanges through official channels.
• Do not enter banking or cryptocurrency credentials on the suspected device until it has been assessed and cleaned.

The specific claims about Manic should be treated as findings attributed to ThreatFabric unless independently confirmed through additional reputable sources. The WiFi Direct and Bluetooth relay capability is especially concerning, but removing internet access alone should not be considered a complete containment measure if the device may communicate with other infected devices.

If a suspicious APK is available, do not install or execute it for testing. Preserve the file safely and submit it to VirusTotal or an appropriate security research service. For an actual infection, detailed logs and the APK should be reviewed by qualified analysts.