A new Trojan for Android bypasses antivirus software and locks smartphones.

      The Department for the Organization of the Fight Against the Illegal Use of Information and Communication Technologies (UBK) of the Ministry of Internal Affairs of Russia has identified a new threat for Android devices — the malicious software Drama RAT. This is not just a virus, but a remote control tool that steals data, gains access to banking applications, and can completely lock the owner's device.

      The main technical feature of Drama RAT is its ability to remain undetected during classic checks. Inside the APK is an encrypted library that only unpacks in the RAM. This means that static analysis of the file does not reveal the threat: as long as the malware is inactive, it is simply invisible.

      Distribution occurs through typical channels for such attacks: messengers, SMS, and email. To persuade the victim to voluntarily install the application, attackers use popular bait. In the mailings, they promise free access to ChatGPT or "Yandex.Music," a new VPN, mods for Minecraft. Additionally, there are files with business-like names — "Declaration" and "Invoice."

      After installation, the user is asked to allow updates. It is under this pretext that the main malicious component is downloaded in the background. The next step is to request access to the Android Accessibility Service. As soon as the smartphone owner clicks "OK," the Trojan gains the ability to read the screen, intercept passwords, and simulate touches. After that, the program demands to set a PIN code — this code allows the attacker to lock the smartphone for the owner themselves.

      An additional complexity for protection is created by the method of communication with the attackers' server. Drama RAT uses mutual authentication: the server checks a unique client certificate embedded in the library. According to UBK, intercepting such traffic with standard tools is extremely difficult.

      Detailed analytics and specific recommendations for protection can be found on the official website of the Ministry of Internal Affairs of Russia for the Kirov region.