The General Directorate of Information Systems Security has warned of a “high-impact threat” targeting Android users.
The malicious virus, named BTMOB RAT, is a remote access Trojan (RAT) first discovered in February 2025. It spreads mainly through phishing sites and malicious apps on Google Play.
According to the Directorate’s memo, the virus exploits Android’s Accessibility Services to gain legitimate permissions, bypass security measures, and maintain persistent access to infected devices.
Its main goal is to harvest sensitive information, such as login credentials, messages, and banking data, by capturing on-screen content. It also monitors the clipboard to steal temporarily stored data like passwords and payment details.
A notable feature of BTMOB RAT is its integration with the malware-as-a-service (MaaS) model, allowing cybercriminals to rent or purchase it for their own campaigns.
To mitigate the risk, the Directorate advises users to avoid downloading apps from outside Google Play, review app permissions carefully, and keep security software up to date.
add your comment
Terms of publication : Not to offend the writer, people, sacred things, or attack religions or the divine self, and refrain from racist incitement and insults.