RatHat Android Malware Uses AI to Remotely Control Devices and Steal Data
Summary
Zimperium researchers describe RatHat, Android malware distributed through malvertising, SMS, and phishing APKs. It uses Accessibility and ADB for control, steals credentials and messages, and applies AI-guided navigation.
Key points
- Zimperium researchers say RatHat is distributed through malvertising, SMS, and phishing sites that promote APK downloads outside Google Play.
- The malware abuses Android Accessibility permissions and enables Developer Options and Wireless Debugging to gain shell-level access.
- Go-based agents execute ADB commands, maintain persistence, restore one another if removed, and establish a reverse-proxy tunnel.
- RatHat uses fake overlays to steal banking and cryptocurrency credentials, and can capture SMS codes, notification content, PINs, passwords, and unlock patterns.
- Its AI subsystem sends a serialized Android Accessibility tree to an unnamed AI assistant for interface analysis and navigation instructions.
- Zimperium links the malware to Chinese threat actors based on Chinese-language LLM prompts; this is a researcher assessment.
- The malware can interfere with uninstall attempts and uses APK tampering, an oversized manifest, and invalid DEX instructions to hinder analysis.
Article Details
- Attack Vectors
- RatHat is distributed through malvertising, SMS, and phishing sites that promote APK downloads outside Google Play.
- The malware abuses Android Accessibility permissions, then enables Developer Options and Wireless Debugging to obtain local ADB shell-level access.
- RatHat uses fake HTML overlays targeting banking and cryptocurrency applications to capture credentials, and intercepts SMS messages and notifications, including one-time passwords.
- It captures text-change events, browser address-bar URLs, and lock-screen PINs, passwords, and unlock patterns.
- A Go-based agent runs ADB shell commands, supports persistence, and creates battery-restriction bypasses; another agent acts as an FRP reverse-proxy client to maintain a tunnel to the attacker.
- RatHat serializes the live Android Accessibility tree into XML and sends it to an unnamed AI assistant for interface analysis and navigation instructions.
- The malware blocks uninstall attempts by canceling the confirmation and displaying a fake Google Play overlay with a bogus error.
- Anti-analysis methods include APK container tampering, a 61 MB Android manifest, and invalid DEX pseudo instructions.
- Defensive Notes
- Do not download APK files from outside Google Play unless the publisher is explicitly trusted.
- Avoid granting Accessibility permissions to apps unless necessary and trusted.
- Regularly scan Android devices with Play Protect.
MITRE ATT&CK
T1406RatHat uses APK container tampering, an oversized Android manifest, and invalid DEX pseudo instructions to hinder analysis.T1412RatHat intercepts SMS messages and notifications, including one-time passwords.T1430RatHat extracts URLs from browser address bars.T1456RatHat is distributed through malvertising and phishing sites that promote APK downloads outside Google Play.T1471RatHat displays fake HTML overlays targeting banking and cryptocurrency applications to capture credentials.T1517RatHat records text-change events and captures lock-screen PINs, passwords, and unlock patterns.
Malware
RatHatRatHat is a new Android malware that uses an AI-powered subsystem to help attackers remotely navigate infected devices and steal sensitive data.RedHookcontext without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families.ToxicPandaexecution context without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families.
Vendors
Products
AndroidRatHat is a new Android malware that uses an AI-powered subsystem to help attackers remotely navigate infected devices and steal sensitive data.Google PlayZimperium links it to Chinese threat actors and notes that it is distributed through malvertising, SMS, and phishing sites that push APK downloads outside Google Play.Play ProtectAndroid users should never download APK files from outside Google Play unless they explicitly trust the publisher, avoid granting Accessibility permissions to apps, and regularly scan their devices with Play Protect.