RatOnMalware
According to ThreatFabric, this RAT can perform NFC relay attacks and has Automated Transfer ystem (ATS) capabilitiesFrom MISP Galaxy
Last reported 7 months ago, by ESET WeLiveSecurity (ES)2 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Panorama infostealer: cambios globales y casos destacados en México y Brasil“El malware moderno ya no solo roba contraseñas; familias como RatOn combinan acceso remoto (RAT), robo de billeteras de criptomonedas (MetaMask) y ataques de relevo NFC.”
-
ESET Threat Report H2 2025“RatOn, entirely new malware on the NFC fraud scene, brought a rare fusion of RAT capabilities and NFC relay attacks, showing cybercriminals’ determination to pursuing new attack avenues.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/nfcgate/nfcgate/wikiin 1 report
Copy this indicator · defanged
Thanks — we review every report.