SpyNote RAT is capable of performing a variety of alarming functions that includes:   Activating the device’s microphone and listening to live conversations  Executing commands on the device  Copying files from the device to a Command & Control (C&C) center  Recording screen captures  Viewing contacts  Reading SMS messages  The screenshot below shows part of the sandbox’s report on the SpyNote RAT’s signature and detected functions:          Figure 1 : Zscaler Cloud Sandbox Detection     The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder, which was leaked last year