RatOn: The New Android Trojan That Steals Crypto and Uses NFC Relay Attacks

ThreatFabric has uncovered RatOn, a newly developed Android banking trojan that merges overlay fraud with NFC relay attacks, automated money transfers, and cryptocurrency wallet theft. The first known RatOn samples date back to 5 July 2025, with continuous development observed through 29 August 2025.

ThreatFabric MTI team explains that the dropper can request permission to install from third-party sources to bypass Android restrictions for Accessibility services, after which a second-stage payload gains full control and a third payload—NFSkate malware—enables NFC relay attacks against victims’ banking cards. Like many Android bankers, RatOn uses overlay attacks, loading overlays from attacker-hosted URLs or injecting HTML chunks to harvest credentials or demand payments.

It also demonstrates automated transfer system (ATS) capabilities, including auto-navigating a Czech banking app and automatically typing the victim’s PIN to confirm transactions, highlighting a focus on Czech accounts and domestic mule networks. Beyond banks, RatOn targets crypto wallets such as MetaMask, Trust Wallet, Blockchain[.]com, and Phantom, with hard-coded ability to auto-type PINs, access recovery settings, and exfiltrate seed phrases.