RatHat Android Trojan Uses AI for Automation

Summary

Zimperium discovered RatHat, an Android trojan that leverages generative AI to intelligently navigate and control infected devices, increasing adaptability and evasion capabilities. The malware is distributed via smishing and malvertising, employs a multi-stage infection pipeline to achieve shell-level execution, and includes features such as credential theft, fake banking app overlays, hardware-level input monitoring, and persistent reinstallation mechanisms. The AI prompts and development patterns suggest the malware was created by a Chinese threat actor.

Full text

A newly discovered Android trojan relies on generative AI to more intelligently navigate and control the infected devices, mobile security company Zimperium reports. Dubbed RatHat, the malware has been distributed through smishing and malvertising, relying on an automated multi-stage infection pipeline to break out of Android’s application sandbox and gain shell-level execution. RatHat contains typical mobile malware capabilities: it steals users’ credentials, mimics banking and payment applications to steal credentials and access codes, and establishes a covert communication channel with the command-and-control (C&C) server for remote access. Unlike other mobile threats, however, it also uses generative AI to navigate and control the device’s interface in real time, and monitors users’ input at the hardware level to reconstruct PIN codes, passwords, and patterns. It also grants itself administrator-level permissions to access system functions, and installs a separate hidden background service to reinstall itself and restore its permissions. The AI prompts used by the malware suggest it was developed by a Chinese threat actor. RatHat, Zimperium says, is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions. Its architecture consists of three parts: a malicious Android application, a Go agent, and an FRP client.Advertisement. Scroll to continue reading. The application gains critical system permissions, bootstraps the infection chain, and provides an interface with the user. It contains a dynamic configuration that allows its operators to enable different activity aliases. It also uses a localized HTML lure to gain access to the Accessibility Services and elevate its privileges. It contains an advanced WebView overlay injection engine to serve fake interfaces of popular apps, captures the device’s screen and user input, intercepts SMS messages, and requests Device Admin rights, which allow it to wipe the device. A particularly unique feature of RatHat is its communication with a generative AI assistant, which it uses for non-malicious actions after it serializes the device’s live Accessibility tree to XML. The AI reads on-screen content and layout to automatically navigate and interact with the device. After gaining a shell via the local ADB daemon, the malware drops and executes an agent written in Go. It functions as the C&C brain of RatHat, executing commands and gaining system-level persistence and power management exemptions. Derived from fatedier/frp, the third malware component is a reverse-proxy client, frpc, that establishes a secure, persistent reverse tunnel, giving attackers access to the ADB daemon for command execution. RatHat can intercept and cancel uninstallation attempts. Even if the user removes the malware, its shell service remains on the device, periodically checks whether the application is still available, and reinstalls it if not. The malware implements keylogging through three specialized mechanisms: it monitors accessibility text-change events to reconstruct what the user typed, reads browser address bars by resource ID, and the Go agent can record, at the hardware level, where the user’s finger touched the screen. The Go agent abuses its execution in a shell environment to use the standard Android debugging tool getevent to read the raw device file the kernel writes to, extracting raw event coordinates and comparing them against the keypad layout. Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews Related: New BTMOB Android Malware Enables Full Device Takeover Related: Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack Related: North Korean Hackers Deploy New Linux Espionage Toolkit Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire NightmareStresser DDoS Service Disrupted in International OperationBrevo Supply Chain Attack Injects Malware Into 100,000 WebsitesCritical Orkes Conductor Vulnerability Exploited in AttacksMIND Secures $72 Million for AI-Powered DLPRevolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M RansomComp AI Raises $34 Million for AI-Native Compliance and SecurityISC Patches 14 Vulnerabilities in BIND 9 Security UpdateCisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard Latest News Dragos Completes NetRise and runZero Acquisitions Following Accenture DealRust Team Members and Popular Crate Owners Targeted via Video CallsCrowdSec Confirms Source Code Stolen in Supply Chain AttackColorado Water Utilities Hit by Cyberattacks Targeting OT SystemsOrganizations Warned of 3 Exploited Linux Kernel VulnerabilitiesGoogle Confirms Gemini AI Breached Three FirmsTigerByte Cyber Emerges From Stealth With $3 Million in FundingIn Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveVeritas Capital has appointed Joel Fulton as Chief Information Security Officer.incident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — RatHat

Entities