Attackers have been using a new spyware against enterprise Android devices, dubbed RatMilad and disguised as a helpful app to get around some countries' Internet restrictions.
For now, the campaign is operating in the Middle East in a broad effort to gather victims' personal and corporate information, according to researchers from Zimperium zLabs. The original version of RatMilad hid behind a VPN- and phone-number-spoofing app called Text Me, researchers revealed in
a blog post published Wednesday. The app's function is purportedly to enable a user to verify a social media account through his or her phone — "a common technique used by social media users in countries where access might be restricted or that might want a second, verified account," Zimperium zLabs researcher Nipun Gupta wrote in the post.
More recently, however, researchers discovered a live sample of the RatMilad spyware being distributed through NumRent, a renamed and graphically updated version of Text Me, via a Telegram channel, he said. Its developers also have created a product website for advertising and distributing the app, to try to fool victims into believing it is legitimate.
