Manic Malware Breaks the Air Gap: How Wi-Fi Mesh Networks Enable Data Theft from Offline Devices
The Manic Android malware campaign emerged in February 2026, targeting Ukrainian banks, government services, and Russian financial institutions through sophisticated phishing sites and dropper applications. This hybrid banking malware and spyware employs a novel Wi-Fi mesh technique that enables infected devices to relay stolen data through nearby compromised devices with internet access, allowing data exfiltration even when the primary device is offline. The malware monitors 169 package IDs across financial, government, and messaging applications, utilizing accessibility services abuse and transparent overlays to capture sensitive data including PIN codes, authentication credentials, and location information. This incident represents a significant evolution in mobile threats, demonstrating how attackers are adapting to air-gapped security measures and developing mesh-based exfiltration techniques. The campaign's timing amid ongoing geopolitical tensions and its focus on Ukrainian infrastructure highlights the intersection of cybercrime and nation-state activities, making mobile device security and network segmentation increasingly critical for organizational defense strategies.
Kill Chain
