A new report out today from mobile security firm iVerify Inc. sheds light on the alarming ease with which cybercriminals can now rent advanced Android malware through subscription-based malware-as-a-service platforms.

The report, “Renting Android Malware Is Getting Easier – and Cheaper,” written by iVerify research fellow Daniel Kelley, explores how services are slashing the technical barrier to entry, allowing virtually anyone with a Telegram account and a few hundred dollars to launch sophisticated attacks.

According to the report, MaaS platforms now offer full-featured malware kits for as little as $300 per month. One such tool, called PhantomOS, includes capabilities such as remote silent app installs, interception of onetime passcodes for two-factor authentication, cloaking to avoid detection and phishing overlays that mimic banking and payment app login screens. Customers are given backend infrastructure, support channels via Telegram and even malware customization options to allow attackers to target specific institutions such as Coinbase Inc. or HSBC Holdings plc without writing any code.

Another tool covered in the report, called Nebula, is described as a lower-cost MaaS alternative focused on stealth and automation. Nebula quietly collects call logs, texts, contacts and GPS data before forwarding the information to the attacker.

Both highlighted MaaS services are regularly updated to stay compatible with new Android versions and include built-in mechanisms to bypass Google Play Protect and other antivirus tools.

Beyond the malware itself, the report notes that the platforms offer distribution tools and “install markets,” where attackers can buy access to already infected devices. Exploit kits, such as one targeting Android Debug Bridge misconfigurations, can scan for vulnerable devices and deploy malware at scale.

For those less inclined to handle infection directly, bulk access to compromised Android phones is available for purchase, with pricing based on geography. A complete botnet operation can be rented, including malware payloads, mass device access and management tools like the Hydra Android botnet, which offers ransomware, keylogging, SMS hijacking and full remote access for about $3,500.

Kelley warns in the report that the commoditization of Android malware is significantly lowers the barrier to entry for cybercrime. Organizations are urged to remain vigilant by using behavioral monitoring and diagnostic analysis to detect infections early.

Image: SiliconANGLE/Reve