Just recently we looked at what viruses exist on Android in 2026, when today Russia’s Ministry of Internal Affairs reported a new dangerous trojan called Drama RAT. This is a remote access program that steals data, infiltrates banking apps, and can completely lock your smartphone. The key thing to understand: infection doesn’t start with hacking — it starts when the user installs a “useful” app from a message themselves.

Your Android will turn into a zombie if this virus gets on your phone

The Department for Combating Illegal Use of IT Technologies of the Ministry of Internal Affairs (UBK) warned that Drama RAT is distributed through messengers, SMS, and email. This means it’s not some narrow group under attack, but ordinary people who simply open a link from an acquaintance or from a mailing list.

How the Virus Gets on Your Smartphone

The scheme is built on familiar bait. Victims are promised free access to ChatGPT or “Yandex.Music”, a new VPN, or mods for Minecraft. More “business-like” file names like “Declaration” and “Invoice” are also used — targeting those who are accustomed to opening work documents.

Then everything looks harmless. After installation, the app asks permission to update, and under this pretext, the main malicious component loads in the background. That is, at the moment of installation, there’s nothing obviously dangerous on the phone — the malware “downloads later,” which is why regular scans often miss it, though basic signs of a virus on Android eventually become noticeable.

Android Accessibility Services — Why They’re Dangerous

The key moment of the attack is the request for access to Accessibility Services. This is a part of Android designed for people with disabilities: it can read screen content and press buttons on behalf of the user. That’s exactly why it’s so interesting to attackers.

Never grant Accessibility Services access to suspicious apps

If you tap “OK” on this request, the trojan gains the ability to read the screen, intercept passwords, and simulate touches. After that, the program requires setting a PIN code, and the attacker can use this same code to lock the smartphone from the owner. Essentially, the person voluntarily hands over control of their phone to a stranger.

What the Virus Does on Android

According to the Ministry of Internal Affairs’ description, Drama RAT turns a smartphone into a fully controlled “zombie.” On the attacker’s panel, the IP address, geolocation, Android version, battery level, and even which app is currently open on the victim’s screen are all visible in real time.

It’s worth separately mentioning why such threats are hard to catch. The Ministry stated that the malicious library is encrypted and deploys only in RAM, so a standard scan of the installation file won’t find it. A secure connection with certificate verification is used to communicate with the command server, making it extremely difficult to intercept such traffic with standard tools. For the user, the takeaway is simple: relying solely on “the antivirus will catch it” isn’t wise — it’s far more important to prevent the program from getting on the phone in the first place.

How to Protect Android from Viruses

Nothing exotic is needed here — basic discipline works. The main rules come down to a few simple points:

  • don’t install apps via links from messages, even if sent by someone you know (their account may have been hacked);
  • download programs from Google Play or another official store, not from APK files in chats;
  • be suspicious of “free” access to paid services like ChatGPT, music, or VPN;
  • never grant Accessibility Services access to an app that clearly doesn’t need it;
  • don’t set a PIN code at the request of a freshly installed program.

If you suspect the trojan is already on your device, it makes sense to disconnect the phone from the internet, delete recently installed apps, and change passwords for banking and email from another device. As a last resort, a factory reset will help.