CampaignPublished 9 Sep 2025

The Rise of RatOn: From NFC heists to remote control and ATS

Source AlienVault OTX General

Description

A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and Slovakia. The malware is distributed through adult-themed websites and employs a multi-stage infection process. RatOn features overlay attacks, automated money transfers, and cryptocurrency wallet takeovers. It demonstrates sophisticated capabilities, including screen casting, PIN interception, and extensive bot commands. The trojan's evolution from a basic NFC relay tool to a complex RAT with ATS functionality makes it a significant threat in the mobile malware landscape.

Impact

For European organizations, especially financial institutions and cryptocurrency service providers, RatOn presents a multifaceted threat. The malware’s ability to compromise banking applications and cryptocurrency wallets can lead to direct financial losses for both individual users and institutions. The use of overlay attacks and PIN interception threatens the confidentiality and integrity of user credentials, potentially enabling unauthorized transactions and account takeovers. Automated transfer capabilities increase the speed and scale at which funds can be stolen, complicating incident response and recovery efforts. The screen casting and remote control features allow attackers to monitor and manipulate user activity, potentially facilitating further targeted attacks or data exfiltration. Given the focus on the Czech Republic and Slovakia, organizations operating or with customers in these countries face heightened risk. Moreover, the infection vector via adult-themed websites indicates a risk to employees who might access such content on corporate or personal devices, potentially bridging personal and professional security boundaries. The threat also underscores the vulnerabilities inherent in mobile banking and cryptocurrency ecosystems, which are increasingly critical components of the European financial landscape.

Defensive guidance

To mitigate the threat posed by RatOn, European organizations should implement targeted and practical measures beyond generic advice. First, enforce strict mobile device management (MDM) policies that restrict installation of applications from untrusted sources, particularly blocking access to adult-themed or high-risk websites on corporate networks and devices. Employ advanced mobile threat defense (MTD) solutions capable of detecting overlay attacks, suspicious NFC activity, and unauthorized screen casting. Encourage users to install applications only from official app stores and educate them about the risks of downloading apps from third-party sites. Implement multi-factor authentication (MFA) for banking and cryptocurrency transactions to reduce the impact of credential theft. Financial institutions should monitor transaction patterns for automated transfers indicative of ATS activity and establish rapid response protocols to freeze suspicious transactions. Regularly update and patch mobile banking applications to address vulnerabilities that could be exploited by overlay or relay attacks. Additionally, conduct targeted awareness campaigns in the Czech Republic and Slovakia to inform users about the risks of NFC relay attacks and RAT infections. Finally, network segmentation and endpoint detection and response (EDR) tools should be employed to detect lateral movement and command-and-control communications associated with RAT activity.

Indicators of compromise

Domains 4

evillab.world
marvelcore.top
tiktok18.world
www-core.top

Hashes 27

1b4527b8f5687a8d611ed13a5d9126e9
25f9892499b735ab3e09d114677bbe37
d6c39adf65a3af9f98fd6ab17629e2c0
f56b9ada5004bb4b4f46ae1c56a7e381
39b40dfb06bc1e6ef389a96f40c2062d30ad1ca7
3ede0fd17962335e0292fbb92d862b1823bd47e8
7f39cf5e2bb0a30993ed467d5014f0e216daa2cd
e907c0da5637567dbfafb619546d7c42bc62f041
01f746d75be3e744f78ad6a9f908bf6fc42b951caf58feb62a0369ffbc5ad836
13f4b05abe78f7a5714f32ecddc9b5b463803c62cd8355f493b42af8cb4fa9db

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Sep 2025, 22:20 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 27

Community reviews

Related threats