Kiran 
A newly discovered Android malware family, dubbed RatHat, is rewriting the rules of mobile banking fraud by pairing generative AI with hardware-level surveillance, and researchers say its tradecraft points to China-based operators.
Zimperium’s zLabs research team identified RatHat as a sophisticated Android threat that abandons the scripted automation typical of older banking trojans in favor of adaptive, AI-driven control.
Rather than relying on brittle, pre-programmed macros to navigate a victim’s device, RatHat feeds a live snapshot of the screen’s accessibility tree to a mainstream generative AI assistant, which then calculates exact tap coordinates and reads on-screen text back to the malware.
RatHat Android Malware Uses AI
That real-time reasoning loop lets the malware react to unfamiliar app layouts on the fly, making it far harder for static detection tools to flag.
Distribution follows a familiar but effective playbook: smishing texts and malvertising campaigns funnel victims to fake download portals hosting malicious APKs disguised as legitimate apps, including at least one build masquerading as a popular streaming service.
What separates RatHat from typical Android spyware is how it escapes the app sandbox entirely. After tricking users into granting Accessibility Service permissions through localized, deceptive prompts, the malware automates Android’s own developer settings, enabling Wireless Debugging and self-pairing with the local ADB daemon without any host computer.
This grants shell-level access under Android’s “shell” UID, unlocking capabilities normal apps can never touch.
From there, two disguised native binaries take over: a Go-based “local service” that executes privileged system commands like exempting itself from battery-saving Doze mode, and an frpc-based reverse-proxy client that tunnels a persistent connection back to the attacker’s infrastructure, bypassing NAT and firewalls entirely.
RatHat’s most alarming trick is a genuine hardware-level keylogger. Using the standard Android debugging tool getevent, the malware’s Go agent reads raw touch coordinates directly from /dev/input, a data stream normal apps cannot access.
Paired with a bundled JSON file mapping keypad layouts for major phone brands, those bare X/Y coordinates are converted into actual PINs, passwords, and unlock patterns, a technique that sidesteps FLAG_SECURE screenshot protections, custom keyboards, and lock-screen masking entirely.
Layered on top are an accessibility-based text keylogger, browser address-bar scraping across Chrome, Brave, Samsung Internet, and other browsers, and deceptive HTML overlays injected over targeted banking and payment apps including WeChat and Alipay to harvest credentials directly.
RatHat’s persistence mechanism is unusually resilient. It intercepts uninstall attempts with a fake “Google Play failure” overlay, and even if a user successfully deletes the app, the background Go service running outside the normal app lifecycle silently reinstalls the APK and re-grants every permission, including Accessibility, without any user interaction.
The malware also maintains four separate anti-analysis layers (corrupted ZIP structures, a 61MB “manifest bomb,” poisoned DEX bytecode, and layered string encryption) plus six anti-debugging checks targeting tools like Frida and Xposed, making forensic teardown deliberately painful.
RatHat signals a broader shift: mobile malware is moving from static scripts toward AI-assisted decision-making that adapts in real time.
Zimperium says its on-device Mobile Threat Defense and Mobile Runtime Protection products detect RatHat’s dropper, ADB abuse, and overlay injection behaviorally rather than through signatures, an approach likely to become standard as more threat actors bolt generative AI onto their malware toolchains.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
