RambleOn is advanced Android spyware discovered in December 2022 after a South Korean journalist received a malicious application from an anonymous source posing as a sensitive tipster. The initial app masqueraded as a secure messenger and enabled theft of contacts, text messages, call content, location, and other device data, using cloud-storage services and mobile push messaging for command-and-control. RambleOn is also called Cumulus and has strong technical links to Android ROKRAT associated with North Korea's APT37, although researchers noted enough functional differences to leave its exact family classification uncertain.