NewsPublished 24 Nov 2025

New RadzaRat Spyware Poses as File Manager to Hijack Android Devices, Evades All 66 Antivirus on VirusTotal

Source Reddit InfoSec News

Description

RadzaRat is a newly identified spyware targeting Android devices by masquerading as a legitimate file manager application. It is notable for evading detection by all 66 antivirus engines on VirusTotal, indicating advanced stealth capabilities. The spyware can hijack devices, potentially compromising user confidentiality and device integrity. Although no known exploits in the wild have been confirmed, the threat is considered medium severity due to its evasion techniques and potential impact. European organizations using Android devices are at risk, especially those with mobile workforces or BYOD policies. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and monitoring device behavior for anomalies. Countries with high Android usage and significant mobile-dependent sectors, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the spyware’s stealth and potential for data exfiltration without user interaction, the threat severity is assessed as high. Defenders should prioritize detection improvements and user awareness to prevent infection and limit damage.

Impact

For European organizations, RadzaRat spyware poses significant risks primarily to confidentiality and integrity of data on Android devices. Organizations with mobile workforces or BYOD policies are particularly vulnerable, as infected devices can lead to unauthorized access to corporate data, credential theft, and potential lateral movement within networks. The spyware’s ability to evade detection complicates incident response and forensic analysis, potentially allowing prolonged undetected presence. This can result in data breaches, intellectual property theft, and reputational damage. The impact on availability is less direct but could occur if the spyware disrupts device functionality or triggers broader security incidents. Given the widespread use of Android devices in Europe, especially in sectors like finance, healthcare, and government, the threat could affect critical infrastructure and sensitive operations. The stealth nature also increases the risk of supply chain compromise if infected devices are used in development or operational environments. Overall, the threat undermines trust in mobile platforms and necessitates enhanced security postures.

Defensive guidance

To mitigate RadzaRat spyware risks, European organizations should implement a multi-layered mobile security strategy. First, enforce strict app installation policies restricting devices to official app stores and vetted applications, minimizing sideloading risks. Deploy advanced mobile threat defense (MTD) solutions capable of behavioral analysis and anomaly detection beyond signature-based antivirus. Regularly update mobile operating systems and security patches to reduce exploitation windows. Conduct user awareness training focused on recognizing suspicious apps and social engineering tactics. Implement mobile device management (MDM) solutions to enforce security policies, control app permissions, and enable remote wipe capabilities. Monitor network traffic from mobile devices for unusual patterns indicative of spyware communication. Establish incident response plans specific to mobile threats, including forensic capabilities to analyze infected devices. Collaborate with threat intelligence providers to stay informed about emerging spyware variants and indicators of compromise. Finally, consider network segmentation to limit access from mobile devices to sensitive resources, reducing potential lateral movement.

Summary

RadzaRat is a newly discovered spyware targeting Android devices by impersonating a legitimate file manager application, a common utility on mobile devices. Its primary technical characteristic is its ability to evade detection by all 66 antivirus engines on VirusTotal, suggesting sophisticated obfuscation or novel evasion techniques that bypass signature-based and heuristic detection methods. The spyware’s capabilities include hijacking Android devices, which likely involves gaining extensive permissions to access sensitive data, monitor user activity, and potentially control device functions remotely. Although specific technical details such as command and control infrastructure, persistence mechanisms, or data exfiltration methods are not disclosed, the evasion success implies advanced malware engineering. No confirmed exploits or widespread infections have been reported yet, but the stealth nature raises concerns about undetected infections. The threat exploits the trust users place in common utility apps, increasing the risk of installation via social engineering or sideloading. The lack of patches or updates means mitigation relies on detection and prevention strategies. This threat highlights the ongoing risk of sophisticated spyware on mobile platforms, emphasizing the need for improved mobile security controls and awareness.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Nov 2025, 11:52 UTC

Technical details

References

Community reviews

Related threats