RatHat Android malware uses AI to hijack devices and steal banking credentials
Zimperium discovered RatHat, a Chinese-origin Android malware that uses AI to hijack phones and steal banking credentials. The malware exploits accessibility features, displays fake overlays on banking apps, and can persistently reinstall itself even after removal attempts.
What happened
Zimperium's zLabs team discovered RatHat, a Chinese-origin Android banking trojan that uses AI to automate device control and credential theft. The malware is distributed via third-party app stores, social media, malvertising, and SMS.
Once installed, RatHat abuses Accessibility permissions to enable Developer Options and Wireless Debugging, then pairs with the device's ADB service to break out of the normal app sandbox. It deploys Go-based agents for shell commands and establishes a persistent reverse tunnel back to attackers.
Reported impact
RatHat shows fake HTML overlays on banking and crypto apps to capture logins and intercept SMS one-time codes. The malware monitors raw touch input to reconstruct PINs, passwords and unlock patterns.
RatHat can reinstall itself through a hidden background service if a victim attempts to remove the main app, and includes anti-analysis tricks such as a bloated 61MB Android manifest and poisoned DEX bytecode to block security tools.
Index analysis
RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.