Manic A Blend of Android Banking Malware and Spyware

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware
• Blog Title: Manic: A Blend of Android Banking Malware and Spyware
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse; optionally cross-reference Generic Hacking > Exfiltration for Wi-Fi Direct/Bluetooth multi-hop relay exfiltration

🎯 Content Summary

Overview

Manic is an actively distributed Android malware family that combines banking-trojan, spyware, data-stealing, and Device Takeover (DTO) capabilities. It does not exploit a documented CVE; instead, it relies on malicious installation, social engineering, and abuse of legitimate Android features—especially Accessibility Services, notification access, overlays, MediaProjection, and broad file permissions.

The malware monitors 169 package IDs🔧 Technical Details

Transparent interception of a legitimate numeric keypad: Malware with Accessibility and overlay access can identify numeric keypad nodes inside a target application, calculate their combined screen bounds, and place a touch-intercepting layer only over that area. For each victim tap, it records the coordinates and nearby UI element, temporarily disables interception, and reproduces the tap at the same position through Accessibility. The legitimate application receives the expected input and behaves normally, while the malware reconstructs the PIN without presenting a fake banking interface.

Semantic keylogging through Accessibility: Accessibility events can expose text and UI context from other applications. Malware can classify captured values as device lock input, four-to-six-digit OTPs, passwords, email logins, long messages, ordinary text, or possible cryptocurrency recovery phrases. Recording the source package, timestamp, manual-versus-A...

🤖 Agent Actions

Updated:

src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md

Added concise sections covering:

• Region-scoped legitimate keypad interception and gesture replay.
• Semantic Accessibility keylogging.
• AES-GCM store-and-forward exfiltration through Wi-Fi Direct, RFCOMM, and BLE GATT peers.
• Relevant reverse-engineering, hunting, and containment indicators.
• Numbered ThreatFabric reference and linked superscript citations.

Validation passed with git diff --check; no forbidden sources were introduced. Full mdBook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse; optionally cross-reference Generic Hacking > Exfiltration for Wi-Fi Direct/Bluetooth multi-hop relay exfiltration".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0