Malware

Oblivion

Oblivion is an Android remote access trojan (RAT) reported by Certo and described as being sold openly on the public web under a subscription model, with pricing cited at $300 per month or $2,200 for lifetime access. It is marketed as easy to use, lowering the technical barrier for cybercriminals and stalkers. The malware commonly infects devices through a fake Google Play update message and includes an APK Builder that can generate trojanized fake apps, including examples masquerading as “Google Services.” Once installed, Oblivion abuses Android Accessibility Service to silently grant itself extensive permissions without user interaction. Reported capabilities include reading private SMS messages to steal banking codes, keylogging to capture passwords and PINs, remotely unlocking a phone after restart, and covert remote control with live screen viewing. During attacker activity, it can display a fake “system updating” animation while the operator navigates apps in the background. Certo reported that its backend infrastructure can support more than 1,000 concurrent victims and that operators can use Tor for anonymity. The malware was reported to target Android 8 through Android 16 and to bypass OEM security layers on major Android brands, specifically including HyperOS, Xiaomi MIUI, OPPO ColorOS, Honor MagicOS, Samsung One UI, and OnePlus OxygenOS. The seller also claimed it had been tested for four months to evade behavioral detection and remain hidden from antivirus software.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1648Serverless ExecutionEvidence1

"Once installed, the apps urge users to enable accessibility services to realize their goals."; "TaxiSpy RAT... abuses Android's accessibility service..."; "The malware abuses accessibility permissions for persistent control"

Stealth

1 technique

T1036MasqueradingEvidence1

“It usually arrives via a fake Google Play update message. Once a user triggers this ‘update,’ … while you see a fake ‘system updating’ animation, the attacker is busy navigating your apps in the background.”

Credential Access

1 technique

T1056.001KeyloggingEvidence1

“use a keylogger to capture every password and PIN you type.”

Collection

1 technique

T1056.001KeyloggingEvidence1

“use a keylogger to capture every password and PIN you type.”

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

"full-fledged remote administration tools such as SURXRAT"; "enabling threat actors to gather sensitive data and execute commands"; "comprehensive remote control"

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the hacker newsNews

Mar 12, 2026

Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

Commercial Android RAT (MaaS) claiming automated permission granting/bypass across multiple OEM Android variants; emphasizes hidden remote control, persistence, and a point-and-click builder to lower operator skill requirements.

risky biz rssNews

Feb 27, 2026

Russian man investigated for extorting Conti ransomware group

Android remote access trojan (RAT) being sold on underground forums.

hackreadNews

Feb 25, 2026

$300 a Month Android Malware ‘Oblivion’ Uses Fake Updates to Hijack Phones

Android remote access trojan sold as a subscription service that abuses Accessibility Service to silently gain extensive permissions, enabling SMS theft (e.g., bank codes/2FA), keylogging of passwords/PINs, remote device control including screen viewing in a hidden mode, and the ability to remotely unlock the phone after restart. Includes tooling (APK builder) to generate convincing fake apps (e.g., Google Services) to aid delivery and evasion.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.