I smell a RAT — new Android malware can hack every top phone maker's security, and costs less than a second-hand iPhone

• Oblivion can intercept SMS, push notifications, and two-factor authentication codes silently
• Malware bypasses Accessibility Service, granting attackers full device control without prompts
• A remote control allows concealed access while the user sees fake overlays

Oblivion is a newly observed Android Remote Access Trojan which reportedly targets a range of popular devices running Android 8 through 16.

Security researchers at Certo have examined the tool, which is sold on a subscription basis starting at $300, and claims to be capable of working on heavily customized systems from Samsung, Xiaomi, and Oppo.

The package includes a builder that allows buyers to generate malicious apps with chosen names and icons, alongside a dropper that imitates legitimate update prompts.