Loading story…
Researchers reported multiple Android remote access trojans using Telegram’s Bot API for command-and-control and data exfiltration, with TeleRAT, IRRAT, and the later HeroRat targeting users primarily in Iran. The malware hid its activity within legitimate Telegram communications while giving operators broad surveillance and device-control capabilities, including theft of SMS, contacts, account data, files, photos, location, and clipboard contents, as well as support for calls, texting, audio recording, picture capture, screen recording, and device settings manipulation. Palo Alto Networks identified 2,293 victims, about 82% tied to Iranian phone numbers, and said the activity likely involved several actors rather than a single group.
The malware was distributed through third-party Android app stores, Telegram channels, social media, and messaging apps using lures such as fake VPN tools, profile-viewer apps, Telegram Finder, free bitcoins, free internet, and social-media follower offers. ESET said HeroRat emerged as a distinct family after source code leaked on Telegram channels, leading to many variants and a commercialized version marketed under that name; once installed, it displayed a fake uninstall message while remaining active. Researchers also found repeated operational security failures around the ecosystem, including exposed bot histories, hardcoded API keys, accessible webhooks, and public advertising of malware code and bot-control libraries, while noting the malware was not observed on Google Play.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET disclosed a new Android RAT family distinct from IRRAT and TeleRAT that used Telegram for command-and-control and data exfiltration. The company said one commercialized variant was marketed on Telegram under the name HeroRat and had not been observed on Google Play.
Palo Alto Networks Unit 42 reported a newly identified Android RAT family called TeleRAT that used Telegram's Bot API for both command-and-control and data exfiltration, alongside ongoing IRRAT activity. The report said the campaign had 2,293 identified victims at the time of analysis, about 82% tied to Iranian phone numbers.
The source code for the Android RAT family was made available for free on Telegram hacking channels in March 2018, which ESET said led to hundreds of parallel variants circulating in the wild.
ESET assessed that the Android RAT family later associated with HeroRat had been spreading in the wild since at least August 2017, primarily via third-party app stores, social media, and messaging apps.
Doctor Web disclosed Android.Spy.377.origin, an Android remote access Trojan distributed as benign-looking apps such as Insta Plus, Profile Checker, and Cleaner Pro that targeted Iranian users. The company said it was the first Android Trojan it had seen using Telegram for command-and-control, with capabilities including SMS, contact, account, photo, and location theft plus remote device commands.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourcenews.drweb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Mobile security researchers reported a newly identified commercial spyware toolkit dubbed **ZeroDayRAT** that provides operators broad, remote control of both **Android and iOS** devices and is being marketed to buyers via **Telegram** channels that include sales, customer support, and updates. Analysis attributed to *iVerify* describes a mass-market packaging of surveillance and info-stealing capabilities typically associated with higher-end commercial spyware, delivered through an operator-facing control panel intended to lower the technical barrier for use. ZeroDayRAT infections are primarily driven by social engineering that tricks victims into installing a malicious mobile binary (e.g., **APK** on Android or an iOS payload), including **smishing** links, phishing emails, fake apps/app stores, and links shared through messaging platforms such as WhatsApp and Telegram. Once installed, the spyware can enable real-time monitoring and data theft, including access to device and SIM details, location tracking, notification/SMS previews, and enumeration of accounts registered on the device—capabilities that can support **account takeover** (including MFA bypass via SMS visibility), targeted social engineering, and theft of banking/cryptocurrency-related data.
Jun 29, 2026