In short: On 4 September 2026, Positive Technologies (PT ESC) published a technical breakdown of Drama RAT — an Android banking trojan that spreads as fake VPN apps (SnakeVPN, FlashVPN), banking clients and game mods. Once installed it requests Accessibility permissions, then intercepts SMS codes, logs passwords, shows phishing overlays and lets attackers remotely control the device. Russia's Interior Ministry had previously warned about Drama RAT; the full technical picture is now public.
What is Drama RAT and where did it come from?
Drama RAT is a banking trojan with full Remote Access Trojan capabilities, documented by the Cyber Incident Response team at Positive Technologies (PT ESC IR). Russia's Ministry of Internal Affairs (Cybercrime Division) had previously issued a public warning about it targeting Android users in Russia. The detailed technical report — covering architecture, evasion techniques and indicators of compromise — was published on 4 September 2026.
The name Drama RAT refers to how the malware stages a convincing performance to make the victim willingly grant it administrator rights. No Android vulnerabilities are exploited — the entire infection chain relies on social engineering. For a broader look at how to protect your phone from tracking and spyware, see our guide on phone privacy.
How Drama RAT gets onto your device
Attackers send links to APK files through messaging apps, SMS and email. The trojan is distributed disguised as:
- Fake VPN apps — SnakeVPN, FlashVPN and similar clones;
- game modifications (Minecraft and others);
- fake updates for music streaming or AI services;
- counterfeit banking apps or tax documents (APK files).
After launch, the app shows an "outdated version" notification with an "Update Now" button. Tapping it downloads the malicious component from an encrypted native library. Critically, decryption only occurs in device RAM at runtime — making static scanning of the package largely ineffective before execution.
The next step is requesting Accessibility Services permission. This single grant gives the trojan control over the screen, the ability to read all UI elements and simulate touches. Once the user taps "Allow", the device is effectively under remote control.
What Drama RAT does after installation
The trojan's toolkit covers most current mobile espionage techniques:
- SMS interception — one-time verification codes are captured before you read them;
- Keylogging — every tap is recorded, including passwords typed into banking apps;
- Overlay phishing — a fake login screen is drawn over the real banking app;
- Screen recording and VNC — attackers see everything in real time and can remotely control the device;
- Camera and microphone access — covert audio and video recording is possible;
- Call spoofing — the trojan can initiate calls and change the displayed number;
- DDoS participation — the infected phone is enrolled in a botnet.
Command-and-control communication runs over WebSocket with TLS mutual authentication (mTLS), plus a backup HTTPS channel using CDN domains that look like legitimate platform traffic from the outside — making network-level detection significantly harder.
Why Drama RAT is hard to detect
The authors invested heavily in evasion. The APK contains over 1,200 junk artifacts, a corrupted AndroidManifest and fake DEX files designed to confuse automated scanners. The core malicious component is stored encrypted and is only decrypted in RAM at runtime.
The trojan also checks its environment: it detects emulators, debuggers and rooted devices, changing behaviour or self-terminating under suspicious conditions. Thirty overlay language templates — including Russian — signal global ambitions with a primary focus on Eastern Europe and Russia.
How to protect your phone and data
Do not install APK files from messages or SMS. Drama RAT does not spread through Google Play — only through third-party APKs. For advice on where to safely download apps including VPN clients, see our guide on downloading VPN apps safely.
Check your Accessibility permissions right now. Go to Settings → Accessibility and verify that only trusted system components or assistive apps you recognise have access. Any unfamiliar app in that list is a red flag.
Enable Google Play Protect and update your firmware. Play Protect detects several variants in the Drama RAT family. Current firmware closes vulnerabilities the trojan might otherwise exploit additionally.
Add a network layer of protection. To be clear: a VPN will not remove a trojan that is already installed — that requires an antivirus. But LiMP VPN with its no-logs policy encrypts network traffic on public Wi-Fi (cafés, airports, hotels) and reduces the risk of data interception from an infected device while you address the problem. More on how it works on our features page.
Sources
This report is based on the technical analysis by Positive Technologies (PT ESC IR) on Habr (4 September 2026) and the public advisory from Russia's Ministry of Internal Affairs (Cybercrime Division). Additional coverage: Rambler Tech, Amic.ru.