Android Trojan 'Fantasy Hub' Malware Service Turns Telegram Into a Hub for Hackers

Android Trojan Fantasy Hub is being sold on Russian‑speaking Telegram channels under a Malware-as-a-Service model, with its operator offering device control and espionage capabilities to buyers. The malware can harvest SMS messages, contacts, call logs, images and videos, and can intercept, reply to and delete incoming notifications, while its bot‑driven subscription model helps new attackers access the tool with a low barrier to entry, according to Zimperium.

It targets financial workflows by supporting fake banking overlays and abusing the SMS handler role to intercept 2‑factor codes, which poses a direct risk to enterprise BYOD programmes and to employees using mobile banking. The service includes a dropper component masquerading as a Google Play update, a C2 panel that shows device and subscription details, and the ability to upload and trojanise APKs, with pricing of $200 per week, $500 per month or $4,500 per year.

Users are guided to create fake Google Play Store landing pages and to bypass restrictions, and the malware relies on WebRTC‑based live streaming and other techniques to exfiltrate data, with banks such as Alfa, PSB, T‑Bank and Sberbank among its overlays targets.