company
Mobile security company credited with analyzing Manic and describing its overlay/Accessibility tradecraft and Wi-Fi Direct/Bluetooth relay exfiltration.
No evidence-backed relationships are recorded.
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
4 publishersReality
ThreatFabric traced the StreamRat dropper through four ordinary Android permission prompts to an Accessibility grant that hands operators keystrokes, credential overlays and remote control, with no infection count published.
Reality
The Georgia Tech corpus says the handset belongs to the attacker while Regulation E says the loss belongs to the bank, which makes every extra authentication factor pushed to that same phone a purchase with no yield.
Reality
ThreatFabric says the Android trojan hands collected data to nearby infected devices over Wi-Fi Direct or Bluetooth until one can reach command and control.
Reality
ThreatFabric says the Android malware encrypts what it steals and passes it over Wi-Fi Direct and Bluetooth until it reaches an infected device that is online. Network egress control never sees it.
Reality