Particle.news
Download on the App Store
4 ARTICLES
·
4w ago

RatHat Trojan Uses Generative AI to Steal Banking Credentials on Android

Security researchers warn the malware repurposes Android accessibility and developer features to gain persistent, shell-level remote control.

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time
New malware called RatHat is targeting Android devices.

Overview

  • Security firm zLabs published a technical analysis that was reported by multiple outlets, which researchers released Monday, describing RatHat’s AI-driven automation and low-level input capture.
  • RatHat sends the phone’s live Accessibility tree to a generative AI assistant so the malware can read on-screen content and decide taps and swipes in real time rather than following fixed scripts.
  • The trojan creates fake WebView overlays, intercepts SMS and notifications, and logs raw touch coordinates to reconstruct PINs and unlock patterns so it can harvest logins and one-time codes.
  • After getting Accessibility permission the malware enables Wireless Debugging or ADB pairing, drops a Go-based agent that runs with shell privileges, and uses an frp-derived reverse-proxy to give attackers a persistent remote tunnel.
  • Researchers say RatHat spreads by smishing, malvertising and fake download pages that coax users into sideloading APKs, and they warn that infected phones may need a factory reset to fully remove the persistent shell agent and restore security.