Mouse Money Transfers: Automate Payments with Your Computer
- A new Remote Access Trojan (RAT) for Android, dubbed RatOn, is spreading via a fake adult version of TikTok, 'TikTok18+', to steal user data and financial data.
- RatOn is a sophisticated android RAT that masquerades as a legitimate submission to trick users into installing it.
- once installed, RatOn requests permissions that appear standard but are crucial for gaining control of the device.
RatOn Android Trojan Disguised as fake TikTok App Targets Users
Table of Contents
A new Remote Access Trojan (RAT) for Android, dubbed RatOn, is spreading via a fake adult version of TikTok, ‘TikTok18+’, to steal user data and financial data. Discovered by ThreatFabric, the malware is linked to the NFSKATE group and employs sophisticated techniques to evade detection.
Last Updated: September 18, 2025, 20:10:30 UTC
What is RatOn and How Does it Work?
RatOn is a sophisticated android RAT that masquerades as a legitimate submission to trick users into installing it. According to ThreatFabric’s research, the current campaign utilizes a fake version of TikTok aimed at adults, named ‘TikTok18+’. This app is promoted through various channels, enticing users with restricted content.
once installed, RatOn requests permissions that appear standard but are crucial for gaining control of the device. These permissions allow the attackers to:
- Access and steal sensitive data, including banking credentials.
- Monitor user activity, including SMS messages and call logs.
- Control the device remotely, potentially for malicious purposes.
- Bypass security measures and remain undetected.
The TikTok18+ Deception
The use of a fake adult version of TikTok is a particularly cunning tactic. The attackers leverage the popularity of TikTok and the appeal of restricted content to lure unsuspecting users. 20 Minutos reported on similar tactics used by other malware, highlighting the growing trend of malicious apps disguising themselves as popular platforms.
The ‘TikTok18+’ app is not available on official app stores like Google Play. users are directed to download it from third-party websites, increasing the risk of infection. These websites often lack security checks and can easily distribute malware.
NFSKATE: The Group Behind RatOn
ThreatFabric attributes the RatOn campaign to a threat actor group known as NFSKATE. This group has previously been linked to NFC-based heists and other malicious activities. Their evolution from NFC attacks to sophisticated RATs demonstrates their adaptability and increasing technical capabilities.
NFSKATE appears to be actively developing and refining RatOn, adding new features and improving its evasion techniques. This suggests a long-term commitment to this malware and a continued threat to