A newly discovered Android malware strain named RatHat uses generative AI to navigate and control infected devices in real time. Mobile security firm Zimperium identified the threat, sharing its research with Hackread.com. zLabs links RatHat to threat actors that appear to be operating in China.
Unlike traditional mobile threats that rely on fixed scripts, RatHat serializes the device’s live Accessibility tree into XML and sends it to a generative AI assistant. The AI can return screen coordinates, identify on-screen text and provide navigation commands such as scrolling.
Zimperium says RatHat also uses WebView-based HTML overlays that appear over targeted banking and crypto apps, presenting fake interfaces designed to capture users’ login credentials. The malware can also target payment apps such as WeChat and Alipay with deceptive overlays to steal PINs, while an SMS receiver and notification listener can intercept OTP and 2FA codes.
Multi-Layer Stealth and System Access
RatHat is primarily distributed through smishing and malvertising campaigns, as well as third-party forums, which direct victims to deceptive download sites. Victims are tricked into manually installing malicious APKs.
It uses four anti-analysis layers and an anti-debugging layer:
- Container Tampering: Modifies ZIP structures to disrupt analysis tools.
- Manifest Bombing: Uses an AndroidManifest.xml of roughly 61MB containing undocumented chunks that can cause static analysis tools to fail.
- DEX Bytecode Poisoning: Uses malformed metadata that disrupts disassembly.
- String Encryption: Uses StringFog and a custom StringCrypto scheme to conceal strings.
- Anti-Debugging: Checks for debuggers, Frida, Xposed, root indicators, and emulators.
After gaining Accessibility access, RatHat opens Developer Options and enables Wireless Debugging. It then reads the ADB pairing code and dynamic port displayed on the device and uses an embedded ADB library to connect to the phone’s local ADB service.
This lets it launch two Go binaries: a local control agent and an FRP reverse-proxy client. The control agent runs with shell-level privileges, giving it access unavailable to a normal sandboxed Android app.
The FRP client establishes a persistent reverse tunnel to the attacker’s server, providing remote access to the device’s ADB service independently of the malware’s other features.
PIN Theft and Persistent Reinfection
The Go agent uses Android’s getevent utility to read raw touch coordinates from /dev/input/. RatHat matches those coordinates against phone-specific keypad and pattern layouts to reconstruct PINs and unlock patterns.
This allows RatHat to get around screenshot protections such as FLAG_SECURE by reconstructing credentials from raw touch events rather than captured screen content.
RatHat also uses persistence mechanisms to resist removal. It displays a fake Google Play failure overlay during an uninstall attempt. If the app is removed, the independent local service can detect its absence and reinstall the APK, while restoring runtime permissions and Accessibility settings through shell commands.
The development follows Zimperium’s earlier discovery of PixRevolution, an Android banking Trojan that Hackread.com reported in March. Targeting Brazil’s PIX payment system, the malware used real-time screen streaming and an agent-controlled approach to identify and hijack transactions as they happened.
RatHat, however, differs by using generative AI to automate parts of the device interaction rather than relying solely on a remote operator.
