New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages

Russian-based threat actors are actively distributing a sophisticated Android Remote Access Trojan called “Fantasy Hub” via Telegram-based Malware-as-a-Service channels, according to GBHackers.

The malware represents a dangerous convergence of advanced evasion techniques, social engineering, and deep system‑level access, with researchers from Zimperium’s zLabs documenting extensive capabilities and a paid subscription model designed to lower barriers to entry for novice attackers seeking to compromise Android devices at scale. It can exfiltrate SMS messages, contacts, call logs, images, and videos while retaining the ability to intercept, modify, and delete incoming notifications.

Buyers can choose the icon, name, and page to impersonate, receive a dedicated Telegram bot for automated subscription management, and access a malware builder to deploy customised instances targeting specific victims. The dropper is injected to the builder and masquerades as a Google Play System Update to reduce suspicion, with the malware using a WebRTC real‑time streaming capability and a Russian-language command-and‑control panel to show device status and subscription details. The campaign has targeted financial institutions including Alfa-Bank, PSB, Tbank, and Sber through phishing windows that harvest credentials.