Androrat - Android Remote Access Tool
Summary: Androrat was an Android remote access tool built by four French university students, completed in one month according to their README, and later removed from the GitHub account where it was hosted. A law enforcement agency gave Cisco Talos a zip file appearing to be a dump of that repository, containing two compiled debug APKs, their source code, class files, and the full server source and dependencies.
Why it matters: The tool's feature set covers contacts, call logs, messages, GPS location, live call and message monitoring, camera capture, microphone streaming, and sending texts or calls, all sent over TCP on a default port of 9999 that is configurable.
Read the original at Cisco Talos ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026