RatHat: AI-Powered Malware Targets Android Users with Advanced Credential Theft

RatHat Emerges as Advanced Android Banking Trojan

Mobile security firm Zimperium has discovered RatHat, a new AI-powered malware targeting Android devices with unprecedented sophistication1

1

. The Android malware is assessed to be operated by China-based threat actors after researchers found LLM prompts written in Chinese embedded within the code2

2

. This Android banking trojan primarily targets popular Chinese payment apps like WeChat Pay and Alipay, though other financial applications remain vulnerable1

1

. So far, researchers have identified 162 infected apps in the wild, which communicate with a dozen servers controlled by attackers1

1

.

Distribution Through Malvertising and Phishing Campaigns

RatHat is distributed primarily through targeted smishing (SMS phishing), malvertising campaigns, and deceptive third-party stores that trick users into downloading malicious APKs from outside the Google Play Store2

2

3

3

. The malware masquerades as legitimate applications such as Google Chrome through fake web pages that mimic the official Google Play Store interface1

1

. According to Malwarebytes research engineer Sav Wheeler, SMS phishing is targeted to each specific user, meaning attack tactics vary from region to region1

1

.

AI to Automate Device Control Sets RatHat Apart

What distinguishes RatHat from traditional malware is its AI-driven automation system. The malware serializes the device's live Accessibility tree to XML and communicates with one of the world's most popular Generative AI assistants3

3

. This AI-assisted agent identifies center coordinates of interface elements, determines actual on-screen text, and returns navigation instructions like 'SCROLL_DOWN'2

2

. "RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," Zimperium explained4

4

. This approach solves a persistent problem for cybercriminals: when banking apps redesign their layouts, traditional malware breaks, but AI-powered malware adapts automatically4

4

.

Exploitation of Accessibility Permissions Enables Admin Control

Like most Android malware families, RatHat abuses Android's Accessibility permissions to perform highly privileged actions2

2

. Once users grant these permissions, the malware navigates the phone's menu system to unlock Wireless Debugging—a legitimate developer tool—and grants itself ADB Shell permissions1

1

. This effectively provides admin-level control over the device. The malware then enables Developer Options and Wireless Debugging to gain local shell-level execution context without requiring an external computer, using mechanisms similar to ToxicPanda and RedHook malware families2

2

.

Multi-Tiered Architecture Ensures Persistent Shell Access

RatHat's architecture consists of three main components: the malicious Android application, a Go-based agent (liblocal-service.so), and an FRP reverse-proxy client3

3

. ADB pairing access allows the Go agent to run commands with ADB shell privileges, create battery-restriction bypasses, and manage persistence mechanisms2

2

. A second agent (libmedia_codec.so) establishes a persistent tunnel to the attacker's infrastructure2

2

. Critically, even if victims uninstall the malware, attackers retain shell access on the device through these independent daemons3

3

. The agents restore each other if removed, creating a self-healing system2

2

.

Credential Theft Capabilities Target Financial Data

RatHat displays HTML overlays for targeted banking and cryptocurrency applications to capture account credentials2

2

. The malware intercepts SMS messages and notifications, including one-time passwords, records text-change events, and extracts URLs from browser address bars2

2

. It can steal raw touch input from touchscreens, allowing reconstruction of PIN codes and pattern unlock codes1

1

. Additionally, RatHat includes a hardware-level keylogger capable of recording finger presses on screen3

3

. The malware operates silently in the background without triggering immediate user suspicion, unlike ransomware attacks1

1

.

Advanced Anti-Analysis Techniques Evade Detection

Zimperium highlights multiple anti-analysis techniques embedded in RatHat, including APK container tampering, a bloated 61MB Android manifest file, and invalid DEX pseudo instructions2

2

. The malware employs four specific methods: container tampering that declares files as directories, manifest bomb with undocumented chunk headers causing analysis tools to crash, DEX bytecode poisoning with invalid attributes, and dual string-encryption using Base643

3

. These layers are designed to confuse or break analysis tools and resist detection efforts.

Persistence Mechanisms Block Removal Attempts

RatHat will actively thwart removal attempts by intercepting the uninstall confirmation screen, canceling the procedure, and displaying a fake Google Play overlay containing a bogus error message2

2

. According to Wheeler, "because of the behavior of the program itself—remasquerading as other apps, dynamically changing its behavior using the AI endpoint—static analysis and quarantining is not enough to remove the malware"1

1

. The only effective removal method is a complete factory reset of the device, which eliminates hidden secondary files that antivirus apps cannot address1

1

. Uninstalling the app alone proves ineffective because the malware retains admin access through hidden files, enabling repeated reinstallation1

1

.

Detection and Prevention Strategies

Malwarebytes, a free antivirus option on Google Play, can detect RatHat relatively easily1

1

. Android users should never download APK files from third-party stores unless they explicitly trust the publisher2

2

. Denying accessibility permissions serves as the critical final defense against mobile malware—while downloading a malicious application is risky, the software remains largely powerless without advanced system privileges1

1

. Users should verify they're using the official Google Play app rather than deceptive imitation websites by checking for address bars, which real apps do not have1

1

. Following standard anti-phishing practices and avoiding accessibility permissions largely removes the RatHat threat1

1

. Zimperium warns that "RatHat's multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient"3

3

.