RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities

A new Android malware named RatOn has evolved from a simple NFC relay tool into a remote access trojan with Automated Transfer System capabilities to enable device-level fraud. According to ThreatFabric, RatOn merges overlay attacks with automatic money transfers and NFC relay functionality, creating a uniquely powerful threat. The first sample was detected in the wild on 5 July 2025, with further artifacts found as recently as 29 August 2025, indicating ongoing development by the operators.

The malware targets Czech and Slovak-speaking users and can drop rogue apps via fake Play Store pages masquerading as a TikTok 18+ variant, then prompt the user to install third‑party sources and grant device access, before executing NFSkate-based NFC relay and ATS actions. It also employs overlay screens that mimic ransom notes to coerce payments, and can exfiltrate seed phrases and perform automated transfers using a local banking account framework, underscoring its potential for cryptocurrency theft.