A newly discovered Android malware strain named RatHat is using artificial intelligence to take control of infected phones and steal banking credentials, according to security researchers at Zimperium's zLabs team.
The malware appears to be linked to threat actors operating in China and spreads through smishing campaigns and malicious advertisements that direct users to download malicious APK files outside of Google Play.
How RatHat Operates
Once installed, RatHat exploits Accessibility permissions to enable Developer Options and Wireless Debugging. This allows the malware to pair with the device's ADB service and break out of the standard app sandbox restrictions.
The malware deploys Go-based agents to execute shell commands and establishes a persistent reverse tunnel to attacker-controlled servers. It displays fake HTML overlays on banking and cryptocurrency applications to capture login credentials and intercept SMS one-time codes used for authentication.
AI-Powered Control and Evasion
RatHat uses artificial intelligence to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect compared to traditional scripted automation.
The malware monitors raw touch input to reconstruct PINs, passwords, and unlock patterns. It can also reinstall itself through a hidden background service if a user attempts to remove the primary app.
Anti-Analysis Features
Researchers identified several anti-analysis techniques built into RatHat, including a bloated 61MB Android manifest and poisoned DEX bytecode designed to disrupt security analysis tools.
