Loading story…
The newly discovered RatOn Android trojan integrates NFC relay 'Ghost Tap' attacks, a full-featured Remote Access Trojan, and an Automated Transfer System. Distributed via fake Play Store pages posing as 'TikTok 18+,' it targets users in Czechia and Slovakia, focusing on banking and crypto wallet apps. RatOn's unique blend of capabilities enables both remote account takeover and in-person payment fraud at scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
zimperium.com
Open sourcezimperium.com
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
RatOn is a new Android banking trojan targeting Czech and Slovakian users, featuring multi-stage infection, NFC relay attacks, and automated transfer systems. It abuses Accessibility and Device Admin privileges to persist, perform overlay attacks, and automate fraudulent transactions in banking and cryptocurrency apps. The malware is distributed via adult-themed domains and integrates with the NFSkate tool for contactless payment fraud.
Jun 29, 2026The newly discovered RatOn Android malware combines NFC relay attacks, overlay phishing, remote access trojan (RAT) capabilities, and automated transfer system (ATS) fraud. It targets cryptocurrency wallets and Czech banking apps, enabling account takeovers, automated money transfers, and ransomware-like device locking. RatOn is distributed via fake Play Store pages, primarily affecting Czech and Slovak users, and demonstrates advanced evasion and attack techniques.
Jun 29, 2026
Researchers documented **RatHat**, an Android banking trojan and remote-access tool tentatively linked to China-based operators. Distributed through smishing, malvertising, deceptive download sites, third-party forums, and trojanized APKs, it abuses Android Accessibility services to enable Wireless Debugging, pair with the device-local ADB daemon, and obtain shell-level execution. RatHat deploys external Go-based daemons and an FRP reverse-proxy client, creating persistence that can survive APK removal and maintaining remote access through NAT and firewall restrictions. The malware targets banking credentials and authentication data through fraudulent payment overlays, Accessibility-driven text capture, SMS and notification interception for OTP theft, screen capture, and raw `/dev/input` touch-event collection that can reconstruct PINs and unlock patterns. It also supports AI-assisted UI automation and uses HTTP, WebSocket, and persistent FRP tunnels for command-and-control. Defenses against analysis include malformed APK and manifest structures, DEX poisoning, encrypted strings, and checks for debuggers, Frida, Xposed, rooted devices, and emulators.
Sep 16, 2026