Fantasy Hub: Russian-sold Android RAT boasts full device espionage as MaaS

Fantasy Hub is described by researchers as a Russian-sold Android RAT offered as Malware-as-a-Service, enabling operators to spy, steal data and control devices via Telegram. The malware can take over infected devices to gather SMS messages, contacts, call logs, images and videos, and can intercept, reply to and delete incoming notifications.

The authors advertise the spyware’s capabilities online and link to a bot that manages paid subscriptions and builder access, with guides to create fake Google Play pages and evade detection. Attackers use it to target banks by displaying counterfeit login windows for Alfa, PSB, Tbank and Sber to steal credentials.

The C2 panel exposes subscription time, device online/offline status, brand/model, last update, user ID and SIM slot info, and sellers document Telegram integration to receive alerts and remotely operate compromised devices; fantasy Hub also employs a native dropper inside a metamask_loader library that decrypts an embedded metadata.dat with a custom XOR, decompresses it, and writes the payload to disk to hide indicators until runtime. according to Zimperium.