Loading story…
Criminals used OmniRAT, a commercially sold remote administration tool, to take full control of Android devices through social-engineering lures and sideloaded apps. In one observed campaign, victims received SMS messages referencing the Stagefright flaw and were tricked into installing an APK named mms-einst8923.apk; the app then displayed a fake MMS notice, unpacked the malware, requested broad permissions, and enabled persistent surveillance and remote control. Avast reported that infected phones could also propagate the campaign by sending SMS messages to trusted contacts, while stolen data was sent to a Russian .ru command-and-control domain.
Researchers later linked GhostCtrl to OmniRAT as a variant or spinoff that significantly expanded the malware’s capabilities. Trend Micro said GhostCtrl was distributed through phishing links and masqueraded as legitimate Android apps, while adding obfuscation, shell-command execution, device rooting, ransomware-like screen locking, covert audio and video recording, SMS/MMS abuse, and encrypted data theft; it also reused infrastructure associated with the RETADUP worm campaign that hit Israeli hospitals. A separate GitHub repository listing for RAT.Android.OmniRAT containing a file named OmniRAT_Cracked.0e19cf.rar further indicated the malware family and its tooling were circulating beyond isolated campaigns.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A visible commit in the threatland TL-TROJAN repository added files under the RAT.Android.OmniRAT directory, which included an archive named OmniRAT_Cracked.0e19cf.rar. The commit was attributed to a user identified as "young thug" with the message "Adding some new files and changing permissions."
Trend Micro published analysis of GhostCtrl, describing it as a variant or spinoff of the commercially sold OmniRAT and detailing three versions with expanded capabilities including data theft, device control, ransomware-like locking, rooting, and covert audio/video capture. The report also linked GhostCtrl to RETADUP infrastructure and identified associated command-and-control domains.
Avast reported an in-the-wild campaign distributing a customized OmniRat variant to Android users through SMS social engineering that referenced the StageFright vulnerability and led victims to download an APK named mms-einst8923.apk. The malware installed persistent remote-access functionality, could send further SMS messages from infected devices, and exfiltrated data to a Russian .ru command-and-control domain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.trendmicro.com
Open sourceblog.avast.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Two newly reported Android **Remote Access Trojans (RATs)**—**SURXRAT** and **Oblivion**—highlight a continued shift toward *commercialized, subscription-based mobile malware* that enables non-expert criminals to gain full control of victim devices and exfiltrate data. Both threats are positioned as scalable offerings (i.e., **Malware-as-a-Service**) with structured sales models and distribution support, lowering the barrier to entry for surveillance, credential theft, and account takeover. The reported infection chains rely heavily on **social engineering** to trick users into installing or activating malicious components, then escalating control by abusing **Android Accessibility Services** to bypass normal interaction and security boundaries. SURXRAT is described as modular and stealth-focused, distributed primarily via **Telegram** channels with tiered licensing/reseller options, and capable of broad data access (e.g., SMS, contacts, location, storage) once high-risk permissions are granted. Oblivion is marketed at roughly **$300/month** (with longer-term pricing tiers) and is delivered via **fake Google Play update** prompts; researchers reported capabilities including SMS theft for banking codes, keylogging, remote unlocking after reboot, and covert live screen viewing while a decoy “system updating” animation distracts the victim, with infrastructure reportedly able to manage **1,000+** concurrent victims (including via Tor).
Jun 29, 2026
GhostBat RAT is a sophisticated Android malware campaign that has recently targeted users in India by impersonating Regional Transport Office (RTO) applications. Attackers distribute the malware through socially engineered messages, including WhatsApp and SMS, which contain shortened URLs leading to malicious APK files hosted on platforms like GitHub and compromised websites. Once a user installs the fake RTO app, GhostBat deploys a multi-stage dropper mechanism, utilizing obfuscation and native libraries to evade detection by static and heuristic-based security solutions. The malware presents convincing fake update prompts and overlay screens that mimic legitimate services such as mParivahan, tricking users into granting sensitive permissions like SMS access and overlay control. Upon obtaining these permissions, GhostBat is capable of harvesting banking credentials, SMS messages, and device identifiers, posing a significant risk to victims' financial and personal data. The campaign's use of Telegram bots for command-and-control (C2) communications allows attackers to remotely manage infected devices and exfiltrate stolen information efficiently. Security researchers have noted that GhostBat's modular architecture enables it to dynamically load additional payloads, further complicating detection and analysis. The campaign marks a resurgence in localized impersonation attacks, leveraging the high trust Indian users place in official RTO apps. Zimperium's Mobile Threat Defense (MTD) and zDefend solutions have demonstrated the ability to detect GhostBat's indicators of compromise (IOCs) on-device, even before public disclosure, highlighting the importance of advanced mobile security. On September 29, 2025, Zimperium detected an instance of GhostBat on a protected device, underscoring the malware's active deployment prior to widespread awareness. The attackers' strategy of combining trusted social engineering vectors with advanced evasion techniques makes the campaign particularly challenging to counter. Security experts recommend that organizations and individuals remain vigilant against unsolicited messages prompting app installations, especially those purporting to be from government agencies. The use of multi-stage droppers and dynamic code loading in GhostBat exemplifies the evolving tactics of Android malware authors. The campaign's reliance on Telegram for C2 communications also reflects a broader trend of leveraging popular messaging platforms for malicious purposes. The incident underscores the need for robust, on-device mobile threat detection capable of identifying both known and unknown malware variants. Organizations are urged to educate users about the risks of installing apps from unofficial sources and to implement mobile security solutions that can detect sophisticated threats like GhostBat. The GhostBat campaign serves as a warning about the increasing complexity and localization of Android malware targeting specific user populations.
Jun 29, 2026