RatOn Android Trojan Combines NFC Relay, Remote Control and Automated Transfers

Sep 9, 2025 · Original article ↗

Summary

ThreatFabric analysts describe RatOn, an Android trojan that combines remote control, NFC relay, automated transfers through a Czech bank app, and cryptocurrency wallet theft. They assess its campaign as targeting Czech users, with Slovakia possibly next.

Key points

ThreatFabric says RatOn was found while monitoring the NFSkate threat actor group; related samples were assembled between July 5 and August 29, 2025.
The campaign used adult-themed websites targeting Czech- and Slovak-speaking users to distribute a dropper that installs the trojan in stages.
RatOn abuses Accessibility and Device Admin permissions for remote control, screen monitoring, overlays, device locking, and credential capture.
Its automated transfer feature uses Accessibility to operate the George Česko banking app and enter a PIN; analysts identified one targeted financial institution.
RatOn can target MetaMask, Trust, Blockchain.com, and Phantom wallets, capturing recovery phrases after unlocking apps with stolen PINs.
The researchers say RatOn can drop or download NFSkate for NFC relay attacks; they assess Slovakia may be a next target, but note the reason for the initial focus on one bank is unclear.
Reported control-server domains include marvelcore[.]top, evillab[.]world, www-core[.]top, and tiktok18[.]world.

Article Details

Attack Vectors: Attackers used adult-themed domains containing “TikTok18+” that directly hosted a malicious dropper application; the report says the pages targeted Czech- and Slovakian-speaking audiences.
The dropper requested permission to install applications from third-party sources, then installed a second-stage APK from its assets. A third-stage NFSkate payload could be dropped by the second stage or downloaded from the web.
RatOn sought Accessibility service access and Device Admin privileges, then used Accessibility services to interact with apps, accept permissions, capture input, and automate transfers.
The malware used overlays to induce victims to open cryptocurrency apps or enter information, and used Accessibility-based interaction to unlock targeted wallets and reveal recovery phrases.
RatOn automated transfers through George Česko by clicking interface elements and entering a PIN code that the report says was intercepted earlier.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`evillab[.]world`	Listed by the report as a RatOn control server domain.
DOMAIN	`marvelcore[.]top`	Listed by the report as a RatOn control server domain.
DOMAIN	`tiktok18[.]world`	Listed by the report as a RatOn control server domain.
DOMAIN	`www-core[.]top`	Listed by the report as a RatOn control server domain.
SHA256	`01f746d75be3e744f78ad6a9f908bf6fc42b951caf58feb62a0369ffbc5ad836`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`13f4b05abe78f7a5714f32ecddc9b5b463803c62cd8355f493b42af8cb4fa9db`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`15734c54d25341317a2f58bbc3c9ed3f8efa73af50fb5feb1ef46b6c3e02cab9`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`3578222693be106eac90343c12f06454b6de6e19a50d31ae5105218c36514bbd`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`49c29e87ba849a6afc82eb8a494d94123ebd70d04c43aebbe9f79d2572c2fecc`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`6bce8f9c3ff27ba6348595898ef898262f853789cdbe96c5fa8a147c0f3b42b9`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`7867e5c24f2ac72f3762c3acd31ffa0a931aac2377a4e6554a20963987dcedee`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`979d0331041d33d4af469f7daf7c5c5d268d1de0c231bdf7994229f00ad7a6a0`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`98c711801e9b89b4d0b4fb6c6fc5e8310ef3da226c7ac7261f04505384cd488a`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`98cb893449ec52efe5b77286a66394f5627b070b7ec3bed715f14bc1b79c87db`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`98e09a8f01980d11177549eea9598ffd573e1be355a05ef7d31b85c6be9a38ce`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`9a52126de022ea4d2fa065fbf368a8a08296f524d172e02e24ccf61f49eb7ad9`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`bbc7f2b5c17f90e4c054bc525d85cb96a791a9fe8c8295894fac50a9722fc908`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`bf82609c55304c468996244d3ecc16348d9bea0891482ca724ffefcfaded8b66`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`ccb725738cded7e2380355a899475dcdd0fae29f77d8998b43cc1bb1bb600494`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`ce2b382ab6633a6bafee6f002c0ea94ab747cf4c98670fad437e5c5ca387a082`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`ea23506d4e1dd97b01b52d41e4f474f2dffa096b279f4e982073cad3e90f0bae`	SHA-256 file hash listed in the RatOn indicators of compromise.
SHA256	`ec3b852ffbede9fa4a5402bb0242df4955660b8b67ae3d21a12cd25ad40b3bb2`	SHA-256 file hash listed in the RatOn indicators of compromise.