Hacking Team: Remote Access Trojan for Android

RCSAndroid capabilities include screen capture; clipboard monitoring; Wi-Fi password collection (including grabbing passwords sent over Wi-Fi for applications like Skype, Facebook, Twitter and so on); recording from the microphone; message collection; location collection; use the front and back cameras; and contact collection (again from a variety of services).

Wiretap wasn't forgotten. RCSAndroid, Trend Micro says, also has a hook into the mediaserver system service to get voice calls in real time.

Trend writes that the config file suggests RCSAndroid's been in the wild since 2012, with a now-defunct command and control server in the USA.