Manic A Blend of Android Banking Malware and Spyware

src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md

@@ -185,6 +185,22 @@ Additional ClayRat commands map the environment and keep C2 resilient:<sup>[[1]]
 - `get_cam` / `get_camera` capture front-camera stills, while `get_keylogger_data` serializes lock PINs plus passwords, view descriptions and hints scraped from sensitive fields.
 - `get_proxy_data` fetches a proxy WebSocket URL, appends the unique device ID and spins a job that tunnels HTTP/HTTPS over the same bidirectional channel (T1481.002 / T1646).
 
+### 8. Region-scoped keypad interception and gesture replay
+
+Instead of drawing a fake banking form, an Accessibility RAT can locate the numeric-key nodes in the **real** application, union their `getBoundsInScreen()` rectangles, and place a touch-consuming overlay only over that keypad. For every victim tap, it records the coordinates and nearby node, temporarily stops intercepting touches, replays a tap at the same coordinates with `dispatchGesture()`, and restores the overlay. The legitimate application therefore receives the expected input and continues normally while the RAT reconstructs the PIN from the intercepted sequence.<sup>[[7]](#references)</sup>
+
+This differs from a pass-through overlay: the malicious window receives the original event and Accessibility injects a second event only after interception is disabled. During reverse engineering, look for `AccessibilityNodeInfo` bounds aggregation next to a small overlay window, coordinate hit-testing, rapid changes to touchability/visibility, and `dispatchGesture()` callbacks that re-arm the overlay.<sup>[[7]](#references)</sup>
+
+### 9. Semantic Accessibility keylogging
+
+Raw `TYPE_VIEW_TEXT_CHANGED`, `TYPE_VIEW_CLICKED`, and window-content events become more useful when records are enriched with the source package, timestamp, target-list membership, and whether text came from Autofill or manual entry. The collector can then classify values such as lock-screen input, 4–6 digit OTPs, passwords, email logins, long messages, and possible wallet recovery phrases before upload, allowing operators to prioritize authentication material rather than reviewing an undifferentiated event stream.<sup>[[7]](#references)</sup>
+
+### 10. Peer-assisted store-and-forward exfiltration
+
+An Accessibility RAT can keep collected files and command results in a durable queue, encrypt each package with AES-GCM, and relay it through nearby infected phones when direct C2 access is unavailable. One observed design tries an established Wi-Fi Direct peer first, then queries classic Bluetooth RFCOMM or BLE GATT peers for Internet reachability. A reachable peer accepts the encrypted package and forwards it toward C2; unroutable items remain queued for retry, and a hop counter (four hops by default in the observed implementation) bounds multi-device forwarding.<sup>[[7]](#references)</sup>
+
+Static and dynamic triage should correlate queue persistence and `AES/GCM/NoPadding` with `WifiP2pManager`, RFCOMM `BluetoothSocket`, `BluetoothGatt`, reachability probes, and decrementing hop/TTL fields. Containment must isolate local radios or physically separate suspected devices as well as blocking Internet access, because a nearby compromised peer may provide the egress path.<sup>[[7]](#references)</sup>
+
 ---
 
 ## PlayPraetor – command & control workflow
@@ -329,5 +345,6 @@ Background and TTPs: https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-t
 - [4] [Android accessibility documentation – Automating UI interaction](https://developer.android.com/guide/topics/ui/accessibility/service)
 - [5] [The Rise of RatOn: From NFC heists to remote control and ATS (ThreatFabric)](https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats)
 - [6] [GhostTap/NFSkate – NFC relay cash-out tactic (ThreatFabric)](https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay)
+- [7] [Manic: Blend between Banking Malware & Spyware (ThreatFabric)](https://threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware)
 
 {{#include ../../banners/hacktricks-training.md}}