The Russian Ministry of Internal Affairs warned about a new threat to Android devices – the malicious program Drama RAT. According to the agency, the Trojan can gain remote access to a smartphone, steal data, interfere with banking applications, and even block the device for its owner.
The virus spreads through messengers, SMS, and email. Users may be promised free access to ChatGPT or Yandex Music, a new VPN, Minecraft mods, or sent files with names like "Declaration" or "Invoice." After installation, the application asks for permission to update, and then stealthily downloads the main malicious part.
The main risk begins after requesting access to "Accessibility Services." If the user agrees, the Trojan gains the ability to read screen content, intercept passwords, and simulate taps. Then the program may require setting a PIN code so that attackers can block the smartphone.
The Russian Ministry of Internal Affairs notes that Drama RAT is difficult to detect with conventional analysis methods: part of the malicious code is deployed only in RAM. After infection, the device effectively turns into a controlled "zombie" smartphone: attackers can see the IP address, geolocation, Android version, battery charge, and even the application open on the victim's screen.
Users should be more cautious about APK files, links from messages, and offers of "free access" to popular services. Applications that immediately after installation require additional permissions, access to special features, or security settings are especially dangerous.