RatOn Android Banking Trojan Emerges with NFC Relay and Automated Transfer Capabilities
2 sources · Updated 5mo ago · First seen Sep 20, 2025
RatOn is a new Android banking trojan targeting Czech and Slovakian users, featuring multi-stage infection, NFC relay attacks, and automated transfer systems. It abuses Accessibility and Device Admin privileges to persist, perform overlay attacks, and automate fraudulent transactions in banking and cryptocurrency apps. The malware is distributed via adult-themed domains and integrates with the NFSkate tool for contactless payment fraud.
Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.
Check your exposure