Manic Android Malware Harvests Credentials via Accessibility Service, Exfiltrates Data Offline
What Happened — ThreatFabric’s Mobile Threat Intelligence team identified “Manic,” an Android malware family that combines banking fraud and spyware. It uses the Accessibility service as a UI keylogger, captures lock‑screen PINs, 2FA codes, passwords, and other sensitive text, and can exfiltrate the data even when the device is offline via a Bluetooth relay.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how unchecked app permissions can bypass SOC 2 CC6 (Logical Access) controls, creating gaps in credential protection.
- Highlights the need for continuous monitoring of mobile device configurations as audit evidence of “least‑privilege” enforcement.
- Reinforces the importance of Security Awareness Training to reduce user‑initiated installation of malicious apps.
Who Is Affected — Financial services (banks, fintech, crypto exchanges), government identity services, and any organization whose employees use Android devices for sensitive transactions.
Recommended Actions
- Enforce strict Mobile Device Management (MDM) policies that block third‑party Accessibility and notification‑access requests unless explicitly approved.
- Map the Accessibility‑service misuse to SOC 2 CC6 controls, collect permission‑grant logs as evidence, and integrate them into your continuous‑compliance dashboard.
- Conduct targeted security‑awareness sessions on the risks of granting high‑privilege permissions to unknown apps.
Technical Notes — Manic monitors 169 Android apps, employs in‑memory DEX loading, anti‑analysis checks, and a “lock‑secret phishing” UI overlay to harvest device PINs. Exfiltration occurs via a Bluetooth relay, allowing data theft even when the phone lacks network connectivity. Source: SecurityAffairs