zLabs researchers have uncovered Fantasy Hub, an Android Remote Access Trojan (RAT) being sold on Russian-language channels as a Malware-as-a-Service (MaaS) subscription. The spyware enables full device compromise, including theft of SMS messages, contacts and call logs, live audio and video streaming, and fake banking login screens to steal credentials.
Unlike standalone malware kits, Fantasy Hub operates as a turnkey service complete with seller documentation, how-to videos and a Telegram-based subscription bot. Subscribers receive detailed instructions for creating counterfeit Google Play pages, app icons and cloned versions of trusted apps, including Telegram, to deceive users into installing the malicious dropper.
Key findings include:
- Subscription-based model: Lowers the barrier to entry with automation, bot-based management and builder tools.
- Financial targeting: Used to impersonate banks such as Alfa, PSB, Tbank and Sber to steal mobile banking credentials.
- Abuse of SMS privileges: Exploits Android’s SMS handler role to intercept two-factor authentication messages without the user’s knowledge.
- Evasion tactics: Disguised as a Google Play update, it checks device environments to avoid analysis and detection.
Fantasy Hub’s MaaS model demonstrates how advanced mobile spyware is being commoditised. With integrated automation and support, even low-skilled attackers can deploy sophisticated campaigns targeting financial systems and enterprise BYOD devices.
“Fantasy Hub shows how professionalised seller support is turning complex spyware into accessible services” said Vishnu Pratapagiri, zLabs researcher: “Organisations must assume even legitimate-looking apps could hide malicious droppers capable of intercepting authentication and sensitive data.”
