SYDNEY – October 6, 2022 – Zimperium, the only mobile security platform purpose-built for enterprise environments, published details today of a newly-discovered Android spyware family dubbed RatMilad. The Zimperium zLabs research team uncovered the RatMilad spyware sample after a failed infection of an enterprise device in the Middle East protected by Zimperium's on-device machine-learning malware engine.
The original variant of the previously unknown RatMilad spyware hid behind a VPN and phone number spoofing app called Text Me. After identifying the RatMilad spyware, the zLabs team also discovered a live sample of the malware family hiding behind and distributed through NumRent, a renamed and graphically updated version of Text Me.
The RatMilad spyware has not been found in any Android app store. Evidence shows the Iranian-based hacker group AppMilad used links on social media and communications tools, including Telegram, to distribute and encourage users to sideload the fake toolset, and enable significant permissions on their device. The malicious actors have also developed a product website advertising the app to socially engineer victims into believing it is legitimate.
After a user enables the app to access multiple services, the novel RatMilad spyware is installed by sideloading, enabling the malicious actor behind this instance to collect and control aspects of the mobile endpoint. The user is asked to allow almost complete access to the device, with requests to view contacts
