rat2 articles
Hirudo Android Trojan Swaps Out Your Banking App From the Inside
Hirudo is a sophisticated Android banking trojan that combines remote access capabilities with an unusual tactic: it detects legitimate banking apps on a victim's device, uninstalls them, and replaces them with trojanized copies that neutralize security checks from within the app itself. Delivered via convincing dropper apps promoted on social media, it currently targets eight Indonesian banking apps and can steal credentials, provide live remote device control, and collect SMS messages. Security researchers at ThreatFabric warn that this approach — moving tampering inside the target app rather than attacking the device externally — represents a significant escalation, and advise financial institutions to enforce integrity checks server-side and rely on layered behavioral analytics rather than trusting signals generated locally on the device.
Flying Eagle Android RAT Source Code Leaks, Fingerprints Spotted on 170 Servers
Source code for the Flying Eagle Android RAT framework is circulating on criminal Telegram channels, with researchers at Hunt.io and NetAskari identifying matching infrastructure on 170 internet servers, though this figure reflects server fingerprints rather than confirmed victims or active command-and-control systems. The toolkit, disguised as a fake Chinese public security app, supports keystroke and payment-password capture, screen recording, camera access, and phishing overlays, and its builder generates obfuscated APKs with encrypted C2 URLs. Researchers also identified a separate Android RAT called Night Dragon being promoted by one of the same Telegram channels, though it appears to be an independent, financially motivated tool unrelated to the 2011 espionage campaign of the same name.