New RatHat Android Malware Deploys AI to Automate Device Control and Steal Banking Credentials

RatHat Emerges as AI-Powered Android Malware Threat

Mobile security firm Zimperium has uncovered RatHat, a sophisticated Android malware that weaponizes artificial intelligence to automate device control and steal sensitive financial data1

1

2

2

. The China-based threat actors behind this campaign have developed a banking trojan that fundamentally changes how malware operates on compromised devices. Unlike traditional Android malware that relies on hardcoded scripts, RatHat employs an AI-powered subsystem that interprets live screen layouts in real-time, making it significantly more adaptable and harder to detect3

3

. Researchers have identified 162 infected apps in the wild, with command-and-control infrastructure spread across a dozen servers1

1

. The malware primarily targets popular Chinese payment platforms like WeChat Pay and Alipay, though it can compromise any financial application.

How RatHat Infiltrates Android Devices

RatHat spreads through multiple distribution channels including smishing campaigns, malvertising, and deceptive third-party download portals that mimic the Google Play Store2

2

5

5

. The infection begins when victims download what appears to be a legitimate app, such as Google Chrome, from a fake website designed to look like the official app store. Once installed, the malicious application requests accessibility services permissions while maintaining its disguise as a trusted program1

1

. This social engineering tactic proves highly effective because users often grant these permissions without fully understanding the implications. The malware then abuses accessibility permissions to navigate the device's menu system autonomously, enabling Developer Options and activating Wireless Debugging without any user interaction2

2

.

AI-Driven Automation Powers Advanced Credential Theft

What distinguishes RatHat from conventional Android malware is its integration with generative AI for operational control4

4

. The malware serializes the device's live Android Accessibility tree into XML format and transmits it to a popular AI assistant, which Zimperium researchers found uses prompts written in Chinese3

3

. This AI component identifies center coordinates of interface elements, determines actual on-screen text, and returns navigation instructions such as 'SCROLL_DOWN' to guide the malware's actions2

2

. This AI to automate device control eliminates the need for operators to hardcode specific app layouts, allowing RatHat to adapt instantly when banking apps redesign their interfaces5

5

. The system provides remote control capabilities without requiring real-time operator interaction, making the malware more autonomous and dangerous than traditional banking trojans.

Multi-Stage Architecture Enables Shell-Level Access

RatHat's technical architecture consists of three core components working in concert to maintain persistent control3

3

. The malicious Android application serves as the initial entry point, while a Go-based agent (liblocal-service.so) executes commands with ADB shell privileges. Through Wireless Debugging and ADB pairing, the malware breaks out of Android's standard application sandbox to gain shell-level execution context2

2

. This technique, similar to methods seen in ToxicPanda and RedHook malware families, grants RatHat admin-level access to the entire device. The third component, an FRP reverse-proxy client (libmedia_codec.so), establishes a persistent tunnel to attacker-controlled servers, creating a general-purpose backdoor that carries whatever commands operators want to execute3

3

.

Screen Recording and Keylogging Capture Sensitive Data

Once established on a device, RatHat deploys multiple data collection mechanisms that records your screen touches to steal passwords and other credentials4

4

. The malware captures raw touch input directly from the touchscreen, allowing it to recreate PIN codes and pattern unlock codes1

1

. It also implements screen recording using Android's MediaProjection API and maintains a hardware-level keylogger executed by the Go Agent3

3

. The malware intercepts SMS messages and notifications to capture one-time passwords, records text-change events, and extracts URLs from browser address bars. It displays HTML overlays atop targeted banking and cryptocurrency applications to perform credential theft in real-time2

2

. This comprehensive surveillance operates silently in the background without triggering immediate red flags that would alert victims.

Advanced Persistence Defeats Standard Removal Methods

RatHat incorporates sophisticated anti-removal techniques that make it exceptionally difficult to eliminate5

5

. When users attempt to uninstall the malicious app, RatHat intercepts the uninstall confirmation screen, cancels the procedure, and displays a fake Google Play overlay containing a bogus error message2

2

. The malware's dual-agent architecture provides bidirectional restoration capabilities—the Go Agent restores the main malware if removed, while the malware reinstalls the agent if it's stopped2

2

. Even after successful app uninstallation, attackers retain shell access through independent native daemons that persist outside the application lifecycle. Sav Wheeler from Malwarebytes confirmed that simply uninstalling the app proves ineffective because the malware maintains admin access through hidden secondary files1

1

. The only reliable removal method requires a complete factory reset of the device.

Anti-Analysis Techniques Evade Security Detection

The developers of this new AI-powered malware have embedded multiple layers of anti-analysis and anti-debug checks to sidestep detection by security software3

3

. RatHat employs container tampering by declaring certain files as directories in the package or setting ZIP encryption flags that confuse standard analysis tools while remaining functional on Android devices. The malware includes a manifest bomb—a bloated 61MB Android manifest file with undocumented chunk headers that cause automated analysis pipelines to crash or time out2

2

. DEX bytecode poisoning introduces pseudo-instructions with invalid attributes that break disassembly tools, while dual string-encryption using Base64 encoding resists code analysis3

3

. These sophisticated evasion techniques demonstrate the advanced capabilities of the China-based threat actors behind the campaign.

Protection Strategies and Detection Methods

Android users can protect themselves by following several critical security practices. Never download APK files from third-party app stores or click links in SMS messages from unknown sources1

1

. Verify that you're using the official Google Play app by checking for address bars at the top of the screen—legitimate apps don't have URL bars. Denying accessibility services permissions serves as the critical final defense against mobile malware, as the software remains largely powerless without these advanced system privileges1

1

. Wheeler noted that while downloading malicious applications is risky, following standard anti-phishing practices and avoiding accessibility permissions largely removes the threat. For detection, users should run antivirus scans using tools like Malwarebytes, which can identify RatHat infections1

1

. Zimperium emphasizes that RatHat's multi-tiered architecture and real-time AI decision loops illustrate why traditional signature-based mobile security controls prove insufficient against modern threats3

3

. Regular device scans with Google Play Protect and maintaining skepticism about app permission requests remain essential defensive measures.