Android RATs for Rent: Five Remote Access Trojans and the $150-a-Month Phone Takeover

TL;DR

• Android remote access trojans (RATs) are sold as malware-as-a-service, with a builder and a web panel, at prices set for criminals rather than governments.

• Cellik rents for about $150 a month, Oblivion starts at about $300 a month, and Octagon costs $1,400 a month.

• Most of these kits need no software exploit. They persuade the victim to sideload an app and switch on Android's Accessibility Service.

• In iVerify's enterprise telemetry, 22% of Android devices allow sideloading, 60% run a security patch more than 90 days old and 68% aren't on the latest Android version.

• The defense is restricting sideloading, enforcing OS and patch floors, and detecting malicious apps and permission abuse on the device.

How Android malware-as-a-service works

An Android remote access trojan (RAT) is malware that lets an attacker control a phone from afar, and in 2026 criminals can rent one much the way a business rents software. iVerify's 2026 Advanced Mobile Threat Report sets the two platforms side by side: "On iOS, the story of 2026 is leaked exploits. On Android, it is the remote access trojan." The iOS threat grew out of exploit chains that took nation-state money to build until they leaked, while the Android threat depends on little more than a subscription.

Most kits follow the same model. A subscriber gets a builder that produces the malicious app and a web panel to run attacks from. Some kits add extras such as a Telegram bot for command and control or a tool that wraps the payload inside a legitimate app. Because the builder does the hard work, the buyer needs little technical skill: they pick options, deliver the resulting APK through a phishing message or a fake download page, and manage infected phones from the panel.

Pricing follows the same subscription logic. Oblivion, for example, is sold at $300 a month, $700 for three months, $1,300 for six months, or $2,200 for lifetime access, with 7-day demo accounts for anyone who wants to try before buying.

Five kits iVerify tracked over the past year

iVerify's threat research team documented a steady stream of these kits. Five show the range of what's for sale.

ZeroDayRAT is the outlier because it also claims iOS support. The rest are Android-only, and many of them work the same way. Instead of breaking Android's security model, they get the user to grant access the OS already offers.

Oblivion's "Wealth Assessment" feature shows what the operators are after once they have that access, since it sorts a victim's installed apps so the operator can see at a glance which financial accounts are worth going after.

The common mechanism: Accessibility Service abuse

Most of these RATs take over a phone by persuading the victim to switch on an Accessibility Service for a malicious app, which means no software exploit is required. Android's Accessibility Services exist to help people with disabilities use their phones, so an app granted that access can read what's on the screen and act on other apps. A screen reader or switch-control tool needs exactly those capabilities, and so does a RAT.

Android has tried to close this door. Since Android 13, an app installed from outside Google Play cannot be granted an Accessibility Service until the user opens its App Info page and taps "Allow restricted settings". The RATs treat that as one more screen to walk the victim through, which is why Oblivion's dropper includes a page that guides the user through enabling sideloading and why its builder generates a convincing replica of the Accessibility settings screen.

Once access is granted, the report notes malware can read one-time codes, overlay fake login screens, and block its own removal. Oblivion shows how much of the attack rides on that single tap. Its builder generates a replica of Android's Accessibility settings screen with text the operator writes, and if the victim taps Enable, the implant uses its new control of the interface to grant itself other sensitive permissions while hiding the system permission dialogs so the victim never sees them.

That changes what defenders have to look for. As the report puts it, "defenders have to detect malicious apps and permission abuse, not only exploitation," because a detection program tuned to find kernel exploits will miss a RAT that never needed one.

Why enterprise Android fleets leave the door open

iVerify's own fleet telemetry shows why these kits work. More than one in five enterprise Android devices will accept an app from outside Google Play, and most of the fleet runs months behind on security patches.

Sideloading is the main delivery path for these kits, and more than one in five enterprise Android devices has at least one app permitted to install from outside Google Play. Security patches are Android's fixes for known flaws, and because they ship monthly, a phone 90 days behind is missing three rounds of them. These figures cover the enterprise Android devices iVerify monitors.

When the phone ships compromised: Midnight Mimosa

Some Android phones are compromised before anyone opens the box, and no amount of sideloading control or user training helps with those.

In October, Bitdefender documented Midnight Mimosa, malware preinstalled in the firmware of low-cost Android phones that iVerify's report describes as "budget MediaTek-based phones." Bitdefender observed it on "thousands of unique devices across more than 150 countries," and because it lives in firmware, it runs with system privileges from first boot, and users can't uninstall it. With that position, it installs and removes apps and grants permissions without the owner's knowledge, and it talks to a command-and-control service "disguised as a weather API." Before installing a payload, it disables the Google Play Store app and re-enables it afterward, which Bitdefender suggests is meant to avoid Play Protect. The operators use all of this to run ad fraud and to turn the phone into a residential proxy node.

Bitdefender couldn't determine where in the supply chain the malware is added, whether by the manufacturer, a firmware integrator, or another party, which makes device sourcing a security decision for enterprises. A cheap phone bought for a contractor or a frontline team can arrive with a system-level implant already running.

How to defend Android fleets

The controls that matter most close the delivery path, shrink the window of known flaws, and watch for the permission abuse these kits rely on.

1. Restrict sideloading. On managed devices, the Android Management API's untrustedAppsPolicy controls installs from unknown sources. Its default, DISALLOW_INSTALL, blocks them across the whole device. On BYOD phones with a work profile, the ALLOW_INSTALL_IN_PERSONAL_PROFILE_ONLY setting keeps the work side locked down but still lets the employee sideload into the personal profile.

2. Enforce a minimum OS version and patch level. In Microsoft Intune, for example, a device below the minimum OS version "is reported as noncompliant," and a minimum security patch level can be set the same way for both corporate-owned and personally owned work profiles. Pair compliance with conditional access so a noncompliant phone loses access to corporate apps. 

3. Detect malicious apps and permission abuse on the device. A RAT that never exploits anything still leaves signs, such as an Accessibility Service granted to an app with no reason to need one. Detection has to look for that behavior, not just for exploits.

4. Treat device sourcing as a security decision. Buy from vendors whose firmware you can account for, especially for low-cost phones issued at scale.

5. Cover every employee and every platform. Ordinary staff are getting hit on Android and iPhone alike, so coverage can't stop at a short list of executives.

FAQ

What is an Android RAT?

An Android remote access trojan (RAT) is malware that lets an attacker control a phone from afar. Most current kits read the screen, intercept one-time codes, and overlay fake login pages.

How much does Android malware cost to rent?

The kits iVerify tracked range from about $150 a month for Cellik to $1,400 a month for Octagon. Oblivion starts at about $300 a month, with longer subscriptions and lifetime access also on offer.

Does Google Play Protect stop these?

It didn't catch Octagon. While Octagon ran, Play Protect reported "No harmful apps found". Play Protect is one layer, and it works best alongside sideloading restrictions and on-device detection.

Why is Accessibility Service abuse so common?

It gives a malicious app the ability to read the screen and control other apps without exploiting any vulnerability. The attacker only has to convince the user to switch it on.