The spyware is distributed through a fake virtual number generator used for activating social media accounts called “NumRent.” When installed, the app requests risky permissions and then abuses them to sideload the malicious RatMilad payload.
Source: cyware.com