Cumulus, also called RambleOn, is Android malware used by ScarCruft since at least 2019 and classified as a mobile ROKRAT variant with added FCM or Pushy messaging. Operators disguise its APKs as legitimate applications such as messengers, image viewers, or cryptocurrency tools and appear to deliver them directly to selected individuals through messaging services. Three types are distinguished by the messaging service and whether they download Clugin; Types B and C place their main malicious functions in that separate plugin.