AhMyth

AhMyth is an Android remote access trojan (RAT) and open-source malware available on GitHub. The provided content describes it as being distributed through infected Android applications on various app stores and as capable of keylogging, taking screenshots, and intercepting SMS-based one-time passwords (OTPs) used for MFA bypass. AhMyth is also referenced as a tool leveraged in campaigns by multiple threat actors, including Transparent Tribe and Iranian APT activity more broadly. One report states that the IP address 173.249.50.243 had been tied to Transparent Tribe’s CrimsonRAT and AhMyth Android RAT command-and-control activity since at least 2022. The content also notes AhMyth among the top mobile malware families in April 2025 and mentions a modified version of AhMyth being used in the wild.