We Smell A RatMilad Android Spyware

**Executive summary:** Zimperium zLabs discovered and analyzed RatMilad, an Android Remote Access Trojan/spyware distributed via sideloaded fake apps (Text Me / NumRent) promoted on Telegram; the malware harvests SMS, contacts, call logs, files, microphone/camera recordings, GPS and device identifiers, communicates with C2 servers using defined jobIDs, and includes multiple IoCs (package names, domains, SHA‑256 hashes) with guidance for detection and mitigation.