Fantasy Hub, the dangerous malware that spreads on Telegram and puts thousands of Android phones at risk

A new Trojan for Android, Fantasy Hub, has set off alarm bells in the cybersecurity community. Available as “Malware-as-a-Service” (MaaS) on Russian Telegram channels, this malicious software allows attackers to remotely control mobile devices, intercept messages, access cameras and impersonate banking applications. Its open marketing marks a worrying step forward in the democratization of cybercrime.

‍

What is Fantasy Hub and how does it work?

Fantasy Hub is offered with prices ranging from 200 USD per week to 4 500 USD per year, including control panel and documentation for buyers. Attackers can inject the malware into legitimate applications, creating “trojanized” versions that install the Trojan without arousing suspicion. Once active, Fantasy Hub requests to become the default SMS app and obtain accessibility permissions, thus giving full control of the device.

‍

The keys to the attack: how it spreads and compromises devices

Among its most worrying capabilities are:

• Interception of user messages, calls and notifications.
• Overlay on banking apps to steal credentials and 2FA codes.
• Real-time camera and microphone transmission via WebRTC.
• MaaS model, which facilitates access to criminals without technical knowledge.

Its availability on the dark web and Telegram reduces the barrier to entry to mobile cybercrime, expanding the potential number of attackers and victims.

‍

A growing risk in the midst of the expansion of mobile malware

Fantasy Hub comes at a time when attacks on smartphones grew by more than 30% in 2025, especially in online banking environments and cryptocurrency apps. The Trojan exploits user trust in apparently secure applications and the increased use of mobile devices for financial management. Its full spying potential—combined with its easy access—makes it a first-rate threat to individuals and businesses.

‍

Recommendations from Apolo Cybersecurity

To mitigate the risk of Fantasy Hub and other Android Trojans:

• Download only from official sources (Google Play, Galaxy Store).
• Reject apps that request unnecessary or invasive permissions.
• Activate multi-factor authentication (MFA) whenever possible.
• Keep your systems up to date and regularly review the permissions of your apps.
• Train users on how to recognize signs of infection and suspicious behavior.

‍

Protect your device before it's too late

The arrival of Fantasy Hub demonstrates that mobile malware no longer needs experts to spread. Today, any cybercriminal with money can rent their own “trojan on demand”. At Apolo Cybersecurity, we help companies and users protect their mobile ecosystem, detect anomalies and maintain control of their data.

‍