RatOn Android Trojan Combines NFC Relay, RAT, and ATS for Advanced Banking and Payment Fraud

3 sources · Updated 5mo ago · First seen Sep 18, 2025

The newly discovered RatOn Android trojan integrates NFC relay 'Ghost Tap' attacks, a full-featured Remote Access Trojan, and an Automated Transfer System. Distributed via fake Play Store pages posing as 'TikTok 18+,' it targets users in Czechia and Slovakia, focusing on banking and crypto wallet apps. RatOn's unique blend of capabilities enables both remote account takeover and in-person payment fraud at scale.

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

1 event · Sep 18, 2025

Sep 18, 20251y ago
Story first reported
Initial story creation

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Zimperium BlogNews · Sep 17, 2025

Over 143,000 Malware Files Target Android and iOS Users in Q2 2025Open source ↗

Zimperium BlogNews · Sep 16, 2025

Malvertising on Meta Serves Android Users a Crypto-Stealing TrojanOpen source ↗

Osint Team BlogNews · Sep 15, 2025

New Android Trojan Hacks Your Phone’s NFC!!!Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

RatOn Android Trojan Combines NFC Relay, RAT, and ATS for Advanced Banking and Payment Fraud

How this story unfolded

Story first reported

Sources

See the full picture, correlated to your attack surface.

Related stories

RatOn Android Banking Trojan Emerges with NFC Relay and Automated Transfer Capabilities

RatOn Android Malware Emerges as Multi-Vector Threat Targeting Eastern European Users

RatHat Android Trojan Uses Wireless ADB to Steal Banking Credentials

RatOn Android Trojan Combines NFC Relay, RAT, and ATS for Advanced Banking and Payment Fraud

How this story unfolded

Story first reported

Sources

See the full picture, correlated to your attack surface.

Related stories

RatOn Android Banking Trojan Emerges with NFC Relay and Automated Transfer Capabilities

RatOn Android Malware Emerges as Multi-Vector Threat Targeting Eastern European Users

RatHat Android Trojan Uses Wireless ADB to Steal Banking Credentials