Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
- ID
- 16033
- Status
- summarized
- Published
- 20 Aug 2026, 7:26 PM
- Fetched
- 20 Aug 2026, 9:35 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 20 Aug 2026, 9:38 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
ThreatFabric has documented a new Android malware family called Manic, active since February 2026, that combines banking trojan and spyware capabilities. Its standout feature is a Wi-Fi mesh relay technique allowing infected offline devices to exfiltrate data through nearby compromised devices with internet access. It targets 169 package IDs including Ukrainian, Russian, and European banking, government, crypto, and messaging apps, distributed via phishing sites and dropper apps impersonating utilities.
Why it matters
If you build Android apps handling payments, identity, or sensitive communications, the Wi-Fi mesh exfiltration technique means offline or air-gapped assumptions no longer hold—review whether your app's local data encryption and lock-screen credential handling are robust against relay-based exfiltration. For Malaysian builders shipping fintech or e-government apps, the 169-package target list and the impersonation-of-utilities distribution method are worth studying as a threat model, though no Malaysian apps are currently listed as targets.
Discussion angle
The Wi-Fi mesh relay technique is the genuinely novel element—discuss whether any Malaysian-built apps with sensitive local data (e.g., e-wallets, government services) have threat models that account for relay-based exfiltration from devices assumed offline.