RatHat malware harnesses AI to target banking data

Cybersecurity researchers have identified a new Android malware strain that uses generative artificial intelligence to help attackers navigate infected devices and steal banking credentials, payment information and authentication codes.

Zimperium’s zLabs team disclosed the malware, named RatHat, on September 16, saying its technical indicators point to threat actors who appear to be operating from China. The researchers stopped short of definitively attributing the campaign, basing the assessment chiefly on Mandarin-language prompts embedded in the malware’s AI-driven automation system.

RatHat combines spyware, remote-access and persistence capabilities in a multi-stage infection chain. It is distributed mainly through SMS phishing, malicious advertising and deceptive third-party download portals that persuade victims to install Android package files outside the Google Play store, according to the company’s analysis. Some lures have impersonated applications, including streaming services, web browsers and financial tools, to make sideloading appear routine.

Once installed, the malware abuses Android Accessibility permissions and attempts to enable Developer Options and Wireless Debugging. That allows it to establish a local Android Debug Bridge, or ADB, shell context without connecting the phone to an external computer, giving its operators access beyond the restrictions normally imposed on ordinary applications.

The malware then installs a Go-based native agent, identified as liblocal-service. so, which can execute commands with ADB shell privileges. Zimperium said the component can exempt the malicious app from battery optimisation, maintain background execution, interfere with installed packages and help restore RatHat if the main application is stopped or removed.

A second native component, libmedia_codec. so, functions as a reverse-proxy client. It creates a persistent tunnel between the compromised handset and the attackers’ command-and-control infrastructure, providing a separate route for remote access to the device’s ADB daemon and allowing commands to be carried independently of the malware’s built-in functions.

RatHat’s financial-theft features include fraudulent HTML overlays designed to imitate banking, payment and cryptocurrency applications. These can capture login credentials and payment details entered by a victim. The malware can also intercept SMS messages and notifications, potentially exposing one-time passwords and two-factor authentication codes.

Researchers found that RatHat can record text-change events, collect URLs from browser address bars and capture lock-screen credentials, including PINs, passwords and unlock patterns. Its ability to combine screen observation, input collection and privileged shell access gives operators several ways to obtain sensitive financial and personal data from a compromised phone.

The malware’s distinguishing feature is an AI-assisted user-interface automation engine. RatHat converts the device’s live Android Accessibility tree into XML and sends information from that interface to a widely used generative AI assistant that Zimperium did not name.

The AI system can identify the centre coordinates of a requested on-screen element, determine the text displayed by interface components and return navigation instructions such as scrolling commands. Those responses can then guide synthetic clicks and other actions, allowing the malware to adapt to interfaces whose layout or wording may differ between devices or applications.

Zimperium said this approach reduces dependence on rigid, pre-programmed scripts. Traditional mobile malware often relies on fixed screen coordinates, hard-coded element identifiers or manually operated remote sessions. An AI-assisted decision loop can instead interpret changing interface structures and direct actions as the device state changes.

The researchers also documented measures intended to make RatHat difficult to analyse or remove. These include APK container manipulation, malformed or inflated application data and invalid instructions designed to disrupt analysis tools. The malware can also intercept an uninstall confirmation screen, cancel the removal process and display a fake Google Play error message to the user.

Its dropper carries the main payload in encrypted assets and uses Android installation mechanisms to overcome restrictions surrounding protected settings and Accessibility access. The infection still depends on a victim being induced to install an application from an untrusted source and approve permissions that expose powerful device functions.