New ‘Fully Undetectable’ Android RAT Discovered on GitHub

A new Android Remote Access Trojan (RAT) has been released on GitHub under the repository “Huckel789/Android-RAT.” This fully undetectable (FUD) RAT is engineered to evade antivirus detection, maintain persistence in battery-optimized environments, and offer a comprehensive command-and-control (C2C) experience through a web interface.

The RAT distinguishes itself by operating without the need for a desktop or laptop, allowing operators to manage compromised devices using any modern browser on Android, Linux, or Windows. The web-based console connects directly to infected devices, facilitating real-time monitoring and control.

The payload delivery mechanism utilizes legitimate applications to deploy itself seamlessly, leaving no trace of IP addresses or ports in decompiled code. Advanced encryption methods, including AES-128-CBC with PKCS padding, ensure secure communication between the compromised device and the C2C server, making it resistant to traffic analysis.

This RAT provides extensive functionalities, including:

Bypassing MIUI and other Chinese ROM restrictions to ensure uninterrupted execution. Automatic permission granting, icon hiding, and dropper injection into legitimate APKs upon installation. Recording calls, intercepting and sending SMS messages, hijacking credentials from banking apps and crypto wallets, and capturing keystrokes and 2FA codes. File system access for listing, downloading, and deleting files and directories. Live photo, video, and audio capture, as well as screen recordings. Location tracking with real-time GPS coordinates and live camera feed streaming. Ransomware functionality with file encryption and ransom message display.

The developers emphasize a "True Zero Detect" approach, ensuring the RAT permanently evades antivirus and VirusTotal scans. It utilizes anti-emulator and anti-VM detection to operate exclusively on physical hardware, avoiding sandbox analysis. The RAT remains persistent, consuming minimal resources and avoiding suspicious background connections.

The RAT also supports "SCM Phshing" by sending notifications that imitate legitimate apps, leading victims to fake login screens. It can intercept clipboard contents to alter cryptocurrency addresses, and it targets major 2FA tools to capture live codes.

The public availability of an advanced, FUD Android RAT poses significant security concerns. It combines remote access, espionage, data theft, and ransomware capabilities, lowering the barrier to entry for cybercriminals. Security professionals must enhance mobile defenses, enforce strict app vetting, and monitor network behavior for covert C2C channels.

Cybersecurity researchers should analyze the RAT within isolated environments to develop detection signatures and mitigation strategies. Collaboration among incident response teams, mobile security vendors, and law enforcement is crucial to counter the threats posed by this RAT framework.

Based on reporting by GBHackers.