Oblivion RAT - An Android Spyware Platform With a Built-In A...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://iverify.io/blog/oblivion-rat-android-spyware-analysis
• Blog Title: Oblivion RAT - An Android Spyware Platform With a Built-In APK Factory
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (Accessibility Services Abuse / Social engineering install flows) and/or Basic Forensic Methodology -> Specific Software/File-Type Tricks (ZIP/APK tricks, anti-analysis via ZIP flags, manual DEX extraction)

🎯 Content Summary

Title/Context
Oblivion RAT is an Android Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS). The post describes a “production-ready” ecosystem that includes: (1) a web-based APK builder for generating the implant, (2) a separate dropper builder that generates realistic fake Google Play “update” pages, and (3) a command-and-control (C2) panel that provides real-time control of infected devices.

Pricing / commercialization
Advertised pricing: $300/mo...

🔧 Technical Details

Three-page sideloading lure embedded in a dropper APK: Ship a stage-1 dropper that bundles (a) a compressed stage-2 implant (e.g., payload.apk.xz) and (b) multiple fully self-contained HTML pages (inline CSS, no external resources) that mimic a trusted app-store update flow. Use the pages to (1) build trust with fake “security scan” messaging, (2) present a fake store listing and trigger Android’s install capability (e.g., REQUEST_INSTALL_PACKAGES), and (3) provide step-by-step instructions (including screenshots) to convince the user to enable “Allow from this source,” completing sideloading.

AccessibilityService phishing + UI automation to suppress prompts and grant permissions: Present a pixel-perfect clone of Android’s Accessibility settings screen (operator-controlled strings for title/sections/button text). After the victim enables the malicious AccessibilityService, use Accessibility APIs to programmatically navigate Settings and ...

🤖 Agent Actions

Summary:

• Added concise sections on social-engineered sideloading lures, fake Accessibility settings UI + silent permission escalation, and base64 config triage in src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md.
• Linked to existing ZIP anti-reversing guidance and added the blog to References in src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md.

Tests: Not run (not requested).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://iverify.io/blog/oblivion-rat-android-spyware-analysis

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (Accessibility Services Abuse / Social engineering install flows) and/or Basic Forensic Methodology -> Specific Software/File-Type Tricks (ZIP/APK tricks, anti-analysis via ZIP flags, manual DEX extraction)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0