Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud

Report facts: The Manic Android malware targets Ukrainian banks, government and identity services, messaging apps, Russian and European financial institutions, and global fintech and cryptocurrency services, exfiltrating sensitive data and enabling financial fraud, including from devices that may be intermittently offline via nearby infected phones. This places mobile-banking and fintech ecosystems at elevated risk of credential theft, account takeover, and compromise of communications and identity data. RealGround analysis: For organizations building or integrating AI into mobile banking, identity, or financial decisioning workflows, Manic-style malware heightens the risk that input data (credentials, transaction metadata, customer communications) and model-access channels from compromised devices are abused for fraud or insider-like attacks. AI Security Readiness Assessment and AI Agent Business Logic Audit should focus on hardening AI-driven financial flows against compromised mobile endpoints, ensuring strong authentication, anomaly detection, and strict limitations on what mobile clients can instruct AI systems to do with sensitive financial and identity data.