Fantasy Hub RAT MaaS Uncovered: Russian Spyware Uses Telegram Bot and WebRTC to Hijack Android Devices

Researchers at zLabs have uncovered Fantasy Hub, a sophisticated Android Remote Access Trojan (RAT) sold on Russian-language cybercrime channels under a Malware-as-a-Service (MaaS) model. The spyware advertises videos, documentation and Telegram-based subscriptions, enabling full device control, data exfiltration and targeted banking credential theft, with modules for SMS interception, call recording, camera activation and live streaming through WebRTC.

It is not a one-off kit but a MaaS product with a Telegram-based bot that manages subscriptions and a dropper builder, lowering the barrier to entry for novice attackers. The malware can exfiltrate SMS messages, contacts, call logs and images or videos, and can intercept, reply to, and delete incoming notifications. Live audio and video can be streamed via an encrypted WebRTC channel back to the C2 server, with a subtle “Live stream active” message shown during streaming and removed once it stops.

A phishing overlay system targets customers of major Russian banks, including Alfa-Bank, PSB, Tbank and Sber, by spawning fake login screens over legitimate apps to harvest credentials, card numbers and PINs, with the seller providing tutorials to craft customised phishing pages. According to zLabs.