● Covered by 3 sources · 3 reportsMedium impact3 negative
New RatHat Android Malware Uses AI for Automated Device Control
Key points
- RatHat malware uses AI for automated device navigation.
- It abuses Android's Accessibility permissions and Developer Options.
- Malware installs Go-based agents for persistence and remote access.
- It targets banking/crypto apps and intercepts SMS/PINs.
- RatHat malware is attributed to China-based threat actors.
- Malware uses Android Debug Bridge (ADB) to retain shell access after uninstall.
- RatHat is distributed via smishing and malvertising.
- Malware uses multiple anti-analysis techniques to evade detection.
- Zimperium reported on RatHat malware.
- Malware reconstructs user input at a hardware level.
- RatHat installs a hidden background service to reinstall itself.
Discovery of RatHat Malware
Security researchers have identified a new Android malware, RatHat, which incorporates an AI-powered subsystem. This malware enables threat actors to remotely navigate and control infected devices more efficiently. Zimperium zLabs researchers analyzed the malware and suspect a link to Chinese threat actors due to Chinese language prompts found within the malware's Large Language Model (LLM) interactions.
Distribution and Initial Compromise
RatHat is distributed through various methods, including malvertising, SMS messages, and phishing websites that promote APK downloads outside of the Google Play Store. Upon installation, the malware exploits Android's Accessibility permissions to execute privileged actions on the device, a common tactic among Android malware families.
Technical Capabilities and Persistence
A key feature of RatHat is its ability to enable Developer Options and Wireless Debugging, gaining shell-level execution without needing an external computer. This is achieved by installing a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, bypasses battery restrictions, and ensures persistence. A second agent (libmedia_codec.so) establishes a persistent reverse-proxy tunnel to the attacker. The malware also displays HTML overlays to steal credentials from banking and cryptocurrency applications, intercepts SMS messages and notifications (including OTPs), records text changes, extracts browser URLs, and captures lock-screen PINs, passwords, and unlock patterns.
AI-Guided Navigation System
RatHat's most notable innovation is its AI-powered user interface-automation engine. This engine serializes the Android Accessibility tree into XML and sends it to an unnamed AI assistant. The AI then identifies interface elements, determines on-screen text, and provides navigation instructions like 'SCROLL_DOWN'. This AI integration makes RatHat's interface automation more adaptable than traditional script-based methods, allowing remote control without continuous real-time input from operators.
Updates
- Zimperium reported on RatHat malware.
- Malware reconstructs user input at a hardware level.
- RatHat installs a hidden background service to reinstall itself.
- RatHat malware is attributed to China-based threat actors.
- Malware uses Android Debug Bridge (ADB) to retain shell access after uninstall.
- RatHat is distributed via smishing and malvertising.
- Malware uses multiple anti-analysis techniques to evade detection.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub fatedier/frpHow outlets covered it
A new Android trojan named RatHat uses generative AI to navigate and control infected devices, as reported by Zimperium. This malware steals credentials, mimics banking apps, and establishes remote access, but uniquely employs AI to interact with the device interface and reconstruct user input at a hardware level.
A new Android malware named RatHat, attributed to China-based threat actors, uses an AI-powered system to control compromised devices and abuses Android Debug Bridge (ADB) to retain shell access even after the app is uninstalled. This malware is distributed via smishing and malvertising, and it employs multiple anti-analysis techniques to evade detection, posing a significant threat to Android users.
A new Android malware named RatHat has been discovered, utilizing an AI-powered subsystem to automate remote navigation and control of compromised devices. This AI integration allows the malware to adapt its operations without constant real-time operator interaction, making it more sophisticated than previous Android malware families.