RatHat Android Trojan Uses Generative AI to Navigate Infected Devices
Summary
Zimperium reports that RatHat uses smishing and malvertising to infect Android devices, steal credentials, and gain shell access. It uses generative AI to navigate interfaces and has multiple input-capture and persistence mechanisms.
Key points
- Zimperium says RatHat is distributed through smishing and malvertising, using a multi-stage infection process that abuses Android installation APIs and gains shell-level execution.
- The malware uses generative AI to interpret a device’s Accessibility tree and navigate its interface in real time.
- It steals credentials through fake app interfaces, intercepts SMS, and captures input through accessibility events, browser address bars, and raw touch-event data.
- RatHat’s components include an Android app, a Go agent, and an frpc reverse-proxy client that tunnels to the ADB daemon for command execution.
- It can resist removal and reinstall itself through a persistent shell service; Device Admin access also allows it to wipe the device.
- Zimperium says prompts suggest development by a Chinese threat actor, but this is an assessment rather than confirmed attribution.
- Google said it had found no apps containing RatHat on Google Play and that Play Protect protects users against known versions.
Article Details
- Attack Vectors
- Distributed through smishing and malvertising.
- A dropper carries two encrypted assets and abuses native SessionInstaller APIs to bypass restrictions.
- A localized HTML lure seeks Accessibility Services access and privilege escalation.
- The malware uses WebView overlays mimicking popular applications to capture credentials and access codes.
- Defensive Notes
- Google stated that no apps containing RatHat were found on Google Play at the time of its detection.
- Google stated that Google Play Protect automatically protects users against known versions of RatHat and is enabled by default on Android devices with Google Play Services.
MITRE ATT&CK
T1412RatHat captures device screen content and monitors user input, including accessibility text-change events and hardware-level touch events.T1417.001RatHat reconstructs typed input by monitoring accessibility text-change events and reading browser address bars.T1517RatHat intercepts SMS messages.T1624.001RatHat uses a hidden shell service that periodically checks for the app and reinstalls it if removed.T1627.001RatHat uses a generative AI assistant to interpret serialized Accessibility tree data and navigate the device interface.T1628.002RatHat uses an advanced WebView overlay injection engine to display fake interfaces of popular apps.T1636.002RatHat requests Device Admin rights that allow it to wipe the device.T1636.003RatHat mimics banking and payment applications to steal credentials and access codes.T1640RatHat abuses native SessionInstaller APIs to bypass restrictions during installation.T1642RatHat uses a reverse-proxy client to establish a persistent tunnel that gives attackers access to the ADB daemon.T1655.001RatHat uses a Go agent to execute commands after gaining a shell through the local ADB daemon.T1660RatHat attempts to intercept and cancel uninstallation.
Malware
Vendors
Products
AndroidA newly discovered Android trojan relies on generative AI to more intelligently navigate and control the infected devices, mobile security company Zimperium reports.Google Play ProtectAndroid users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services,” a Google spokesperson said.
Tools
Android Debug Bridge (ADB)After gaining a shell via the local ADB daemon, the malware drops and executes an agent written in Go.frpcDerived from fatedier/frp, the third malware component is a reverse-proxy client, frpc, that establishes a secure, persistent reverse tunnel, giving attackers access to the ADB daemon for command execution.geteventThe Go agent abuses its execution in a shell environment to use the standard Android debugging tool getevent to read the raw device file the kernel writes to, extracting raw event coordinates and comparing them against