Oblivion: The New $300 Android RAT That Beats Every Major Phone Manufacturer’s Security

Published: February 24, 2026

Every so often, a piece of malware surfaces that feels like a genuine step-change. Not just another recycled threat, but something built from the ground up to be harder to stop.

Oblivion, a newly emerged Android Remote Access Trojan (RAT), is being positioned as exactly that. Certo’s security researchers have been analyzing the threat — and the evidence suggests the claim deserves serious attention.

Advertised openly on a clear web hacking forum and backed by a full video demonstration, Oblivion targets Android devices running versions 8 through 16. That covers virtually every Android phone in active use today.

What sets it apart isn’t any single feature. It’s the combination: automated permission bypass, hidden remote control, deep persistence, and a point-and-click builder that puts all of it within reach of would-be hackers with even the most minimal level of technical skill.

Built to Sell

The seller presents Oblivion as a ground-up build, explicitly distancing it from the recycled, bug-ridden RATs that flood the underground market.

They claim it has been running in live environments with testers for over four months before its public release, with no crashes and no behavioral detections during that time. Certo’s researchers reviewed the seller’s demonstration video and supporting claims in detail.

The business model is subscription-based, with tiered pricing listed openly on the forum. Buyers don’t receive the underlying source code — instead, they pay for ongoing access to the tool.

The following pricing is listed in the forum post:

1 month — $300
3 months — $700
6 months — $1,300
1 year — $1,900
Lifetime access — $2,200

A Remote Access Trojan (RAT) is a type of malware that gives an attacker full, hidden control over your device — often without you ever knowing. Unlike a simple virus, a RAT can read your messages, watch your screen, and even control your phone remotely.

Fig 1. The forum post promoting the RAT found by Certo’s researchers.

What Oblivion Can Do

Getting In: The Builder and Dropper

Oblivion includes an integrated APK Builder that lets attackers generate a customized malicious app without writing a single line of code. App name, icon, and deployment mode are all configurable through the web panel — making it easy to impersonate a legitimate app like “Google Services.”

A stealth mode produces an app with no visible interface at all, silently requesting permissions in the background.

Alongside this sits a Dropper Builder — a tool designed to get the malware onto your device in the first place. As shown in the video demonstration, the dropper generates a fake Google Play update prompt, complete with a convincing app listing, an “Update Required” notification, and step-by-step instructions guiding the victim to enable installation from unknown sources.

It’s a well-known social engineering technique, but the level of polish here is notable.

Fig 2. Customising an app with the Dropper Builder.

Pro Tip: If you ever see a pop-up urging you to install an update from outside the Google Play Store, treat it as a red flag. Legitimate Android updates are never delivered this way. Always update apps directly through the Play Store.

The Permission Problem

Once installed, Oblivion’s most significant technical achievement comes into play: automated permission granting that requires no interaction from the victim.

Normally, Android asks users to manually approve sensitive permissions — especially Accessibility Service access. Oblivion bypasses this entirely.

And it doesn’t just work on standard Android. The seller claims it handles the customized security layers of:

MIUI / HyperOS (Xiaomi)
One UI (Samsung)
ColorOS (OPPO)
MagicOS (Honor)
OxygenOS (OnePlus)

Together, these brands represent the vast majority of Android devices in use globally.

The video demonstration explicitly shows this working on Android 15, with the permission dialogue suppressed entirely. The seller claims the same works on Android 16.

Fig 3. The malware gaining full control of the device.

Accessibility Service is one of the most powerful — and most abused — features in Android. It was designed to help users with disabilities interact with their phone. But in the wrong hands, it’s essentially a master key.

Once Accessibility Service access is granted, malware can:

Read content from any app on the device.
Tap, swipe, and interact with any element on screen.
Intercept text as you type it — including passwords and PINs.
Suppress notifications and permission dialogs before you see them.

Google has progressively restricted how apps can use this feature across successive Android versions — which is why a tool that claims to bypass those restrictions on Android 16 is so significant.

Hidden Remote Control

VNC (Virtual Network Computing) is a technology that lets someone remotely view and control another device’s screen. Oblivion uses this to give attackers live, hands-on access to a phone. But it goes a step further with Hidden VNC (HVNC) — a version that runs an entirely separate, concealed session that is not visible to the user.

While the victim sees a convincing “System updating…” animation, behind the scenes, the attacker has full interactive control of the device in a completely concealed session. The fake overlay screen is customizable, meaning it can be made to look like a HyperOS update, an antivirus scan, or any other plausible loading screen.

A Screen Reader mode goes a step further, bypassing the black-screen protections that banking apps and crypto wallets use to block screen capture.

Fig 4. The fake system updating screen (left) concealing a hijacked session (right).

Pro Tip: If your phone appears to freeze on an update or loading screen you weren’t expecting — especially after installing an app from outside the Play Store — power it off immediately and run a malware scan. This kind of overlay is a known tactic used by RATs like Oblivion.

Data Harvesting

This is where the real damage is done. Oblivion’s data collection suite is designed to target exactly what financially motivated attackers care about most:

SMS messages — can be read, sent, blocked, and intercepted (including two-factor authentication codes).
Push notifications — can be read and hidden from the victim, even ones from banking apps.
Keylogger — captures every tap in real time: passwords, PINs, and any other input.
Files and installed apps — accessible via a dedicated management panel.
Remote app control — any app can be silently launched or uninstalled remotely.
Auto Unlock — using your captured PIN, password, or pattern, Oblivion can unlock your device automatically, even after a reboot.

Fig 5. The software logging a phone’s SMS messages.

Staying Hidden

Anti-removal is where Oblivion’s developers appear to have invested the most effort.

The malware actively blocks attempts to:

Revoke its permissions
Uninstall the app
Disable Accessibility Service

Different phone brands often heavily modify the version of Android that runs on their devices — Samsung, Xiaomi, and OPPO, for example, all use their own custom interfaces with their own security layers built in.

Many competing RATs reportedly fail within days on these devices. Oblivion claims to persist for months, using a combination of multi-channel self-recovery, complete icon hiding, and process concealment.

The server infrastructure is also designed with operational security in mind, capable of handling over 1,000 simultaneous sessions, even when routed through anonymizing networks like Tor.

Why This Matters

Based on Certo’s analysis, Oblivion represents a meaningful setback for platform-level defenses. Google has spent years tightening restrictions around Accessibility Service abuse and a tool that demonstrably bypasses those protections on even the latest Android version is a significant development.

For everyday users, the risk is real: a single tap on what looks like a routine app update could hand an attacker silent, persistent control of your Android device — including the ability to intercept banking codes, capture passwords, and remotely operate your phone without any visible sign that anything is wrong.

How to Protect Yourself

The good news is that your best defenses are practical steps you can take right now.

Avoid sideloading apps

Never install APK files from outside the Google Play Store unless you have a very specific reason to do so and trust the source completely. The majority of RAT infections start with a sideloaded app.

Be suspicious of unexpected update prompts

Fake update screens are one of Oblivion’s primary delivery methods. If a pop-up is asking you to take unusual steps to install an update, it’s almost certainly not legitimate.

Review your Accessibility permissions

Go to Settings > Accessibility and check which apps have been granted access. If you see anything unfamiliar, remove its permissions immediately.

Pro Tip: Very few legitimate apps actually need Accessibility Service access. If an app you don’t recognize, or one that has no obvious reason to need it, has this permission enabled, that’s a serious warning sign.

Run a security scan

Another way to find out whether something suspicious is already on your device is to run a security scan. Certo AntiSpy is designed to detect the abnormal permission structures and hidden processes that RATs like Oblivion depend on to operate undetected.

Wrapping Up

Oblivion is notable not because any single feature is unprecedented, but because of how much it packages into a commercially available, easy-to-deploy tool.

Automated permission bypass, hidden remote control, persistent anti-removal, and a polished builder interface — all available to anyone willing to pay a monthly subscription. That combination meaningfully lowers the barrier for attacks that would previously have required real technical expertise.

The support for Android 16 is what makes this a development worth watching beyond the usual threat landscape noise.

Google has made progressive restrictions on Accessibility Service abuse a priority across successive Android versions. A tool that credibly bypasses those protections on the latest release — and does so across devices from Samsung, Xiaomi, OPPO, and others — represents a genuine challenge to platform-level defences.

For users, the practical takeaway is straightforward: be sceptical of app update prompts that appear outside the Play Store, audit which apps hold Accessibility permissions on your device, and treat any unexpected loading or system update screen as a potential red flag.

The infection vector Oblivion relies on isn’t sophisticated, but it works precisely because it looks routine.

By Sophia Taylor

Sophia is a Senior Cybersecurity Writer at Certo, with over five years of experience writing about digital security, privacy, and emerging threats. Drawing on a background in IT and technology, she specializes in translating complex cybersecurity topics into clear, practical guidance that helps everyday users stay protected online.