New “Manic” Android Malware Exfiltrates Data via Nearby Devices, Bypassing Traditional C2 Paths
What Happened — A mobile‑focused malware family dubbed Manic has been observed in Europe since February 2026. It combines spyware, banking‑fraud, and remote‑control functions, harvesting credentials through Android’s Accessibility service and, when a direct C2 link fails, relaying encrypted payloads through Wi‑Fi Direct or Bluetooth to other infected phones.
Why It Matters for Compliance & Audit Readiness
- The technique exploits privileged Android services (Accessibility, notification access) that are directly tied to SOC 2 Security and Confidentiality control requirements for “least‑privilege” and “monitoring of privileged access.”
- Multi‑hop, device‑to‑device exfiltration defeats traditional network‑perimeter monitoring, highlighting the need for continuous, endpoint‑level evidence collection and control mapping.
- Verisq’s SOC 2 Access Controls capability can provide the audit‑ready logs and policy enforcement needed to demonstrate that privileged mobile access is properly restricted, monitored, and evidenced.
Who Is Affected – Financial services (banking, payments, crypto wallets), government/eID agencies, and any organization that relies on Android‑based authentication or messaging apps—particularly in Ukraine, the U.K., and broader Central/Western Europe.
Recommended Actions
- Review and tighten Android device policies: restrict Accessibility and notification‑access permissions to approved apps only.
- Deploy continuous mobile‑endpoint monitoring that captures permission grants, overlay activity, and anomalous Bluetooth/Wi‑Fi Direct traffic.
- Map these controls to SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) and retain evidence for audit review.
Source: BleepingComputer – New Manic Android malware can exfiltrate data through nearby devices
Technical Notes – The malware leverages transparent UI overlays and Android Accessibility to act as a keylogger, then encrypts captured data and forwards it via Wi‑Fi Direct or Bluetooth (including BLE) to the nearest infected peer. If no peer is reachable, it retries up to four relay hops. Infection vector appears to be a malicious wrapper that delivers the payload, but the exact delivery method remains unknown. Source: same as above