New $300 Android RAT Boasts Automated Permission Bypass and Hidden Remote Control
Every so often, a new piece of malware emerges that truly shifts the threat landscape. Oblivion, a newly discovered Android Remote Access Trojan (RAT), appears to be one such moment.
Unlike recycled or buggy Remote Access Trojan (RATs) seen across underground markets, Oblivion is promoted as a ground‑up build, tested for months before public release.
The seller offers tiered access $300 for a month or up to $2,200 for lifetime use but no source code, keeping full control of the infrastructure.
The malware targets Android versions 8 through 16, meaning it can infect nearly all devices currently active.
Analyzed by Certo’s security researchers, Oblivion is being openly marketed on a hacking forum, complete with a video demo and subscription pricing that starts at $300 per month.
Its feature set automated permission bypass, persistent access, and a hidden remote control channel makes it especially dangerous because attackers need almost no technical skill to operate it.
Oblivion comes with a web‑based APK Builder that lets operators create malicious apps disguised as legitimate ones, such as “Google Services.”
Dropper Builder that produces fake update pop‑ups prompting victims to install from “unknown sources.” This polished social‑engineering design imitates Google Play updates with alarming realism.
The malware’s standout capability is its ability to automatically grant itself permissions including Accessibility Service access without user interaction.
This circumvents Android’s built‑in security prompts that normally protect users from hidden control apps.
According to demonstrations, Oblivion can bypass the security layers of MIUI (Xiaomi), One UI (Samsung), ColorOS (OPPO), MagicOS (Honor), and OxygenOS (OnePlus) devices.
On Android 15 and 16, it reportedly silences the permission dialogs entirely, giving the attacker full power unnoticed.
Oblivion employs VNC for live remote access, but it goes further with Hidden VNC (HVNC) a stealth session invisible to the victim.
Oblivion’s ability to bypass Android modern permission restrictions marks a serious challenge for platform defenses.
While users see a fake “System updating…” screen, attackers gain full interactive control in the background.
To defeat banking and crypto‑app screen‑capture protection, a “Screen Reader” module extracts content directly, exposing sensitive information like account details or wallet activity.
Certo’s analysis shows Oblivion records everything attackers could want: SMS and 2FA codes, notifications, keylogs, installed apps, and files. It can even auto‑unlock a device using captured credentials.
Meanwhile, anti‑removal defenses prevent users from uninstalling it or revoking permissions. Its infrastructure supports over 1,000 active sessions, routed through anonymizing networks like Tor for resilience.
Google has tightened control around Accessibility Service abuse for years, but this tool shows that those countermeasures can still be subverted.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…