SMS Thieving: Reading, sending, and deleting text messages (often used to bypass 2FA).

Current landscape (as of April 2026)

• Proliferation of RATs: DroidJack inspired many publicly available RATs and toolkits; variants continue to appear on code-sharing platforms and underground markets. Some are sold with support and feature updates.
• Turnover and takedowns: GitHub and other major hosting platforms periodically remove repositories containing active malware, but forks, private distributions, and encrypted releases persist. Threat actors move to decentralized distribution (private channels, forums, encrypted archives) to avoid takedowns.
• Detection & defenses: Mobile security vendors and platform providers (Google Play Protect) improved detection heuristics, runtime monitoring, and restrictions on sensitive permissions. Android OS versions tightened APIs for background access, microphone/camera, and install-from-unknown-sources workflows. Nonetheless, social engineering and sideloading remain primary infection vectors.
• Legal/ethical use cases: Legitimate mobile device management (MDM) and remote-support tools overlap in capability with RATs; the critical difference is consent, transparency, and proper provisioning.

Data Interception: Reading and sending SMS messages, viewing call logs, and accessing contact lists.

For those looking for a modern, actively maintained alternative for legitimate security testing, projects like

In the world of Android remote administration tools (RATs), few names carry as much notoriety as

DroidJack is a RAT (Remote Access Trojan) designed to exploit Android devices, allowing users to remotely access and control a victim's device. Initially created for educational purposes, DroidJack has become a go-to tool for security researchers, penetration testers, and malicious actors alike. Its intuitive interface and extensive feature set have made it a popular choice for those seeking to test the security of Android devices.

What does "updated" mean in this context?

When threat actors claim a tool is "updated," they are usually referring to one of three things: