Manic Android Malware Harvests Data from Offline Phones via Nearby Infected Devices
What Happened — Researchers have identified a new Android banking‑spyware hybrid, codenamed Manic, that can steal data from phones that are not actively connected to the internet. The malware spreads through Bluetooth/nearby‑device pairing and then uses an infected “relay” device to exfiltrate credentials, banking tokens, and messaging data.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in mobile device access controls – SOC 2 CC6.1 (Logical Access) expects documented safeguards for all endpoints, including offline devices.
- Provides a concrete example of why continuous evidence collection (e.g., MDM logs, Bluetooth activity) is essential to prove control effectiveness during an audit.
- Highlights the need for security‑awareness training that covers proximity‑based threats, a requirement for SOC 2 CC1.2 (Control Environment) and CC7.1 (System Operations).
Who Is Affected – Financial services (Ukrainian banks, European fintech, crypto platforms), government identity services, and any organization whose staff use Android devices for sensitive communications.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) – update your mobile‑device policy to require encryption, MDM enrollment, and Bluetooth restrictions.
- Deploy continuous monitoring of Android endpoints (MDM logs, BLE activity) and retain logs as audit evidence.
- Conduct targeted security‑awareness sessions on proximity‑based malware and safe Bluetooth practices.
- Validate that third‑party mobile‑app vendors follow the same controls and obtain evidence for vendor‑risk assessments.
Source: The Hacker News
Technical Notes – Manic combines classic banking‑trojan code with spyware capabilities; it propagates via Android’s “Nearby Share” feature, leveraging Bluetooth Low Energy (BLE) to pair with offline phones. Exfiltrated data includes banking credentials, OTP tokens, and messaging app logs. No public CVE is associated, as the threat exploits legitimate OS features rather than a software flaw.