A sophisticated new Android malware strain named RatHat uses generative AI to independently change device settings, bypass sandbox protections, and target banking credentials, according to security researchers. The campaign, which security company Cleafy traced to nearly 100 deployments of a malicious web console since April 2026, combines malware-as-a-service infrastructure with automated victim-valuation features powered by Google’s Gemini AI model.
Zimperium Discovery Reveals AI-Assisted Navigation and Wireless Debugging Abuse
Security researchers at Zimperium uncovered the RatHat threat, detailing how the malware turns standard app permissions into deep system control. The attack relies primarily on social engineering through SMS phishing, malicious advertising, and deceptive third-party download sites hosting packages that impersonate familiar software like Chrome or streaming applications. Once manually installed outside the Google Play Store, the malicious APK prompts the user to enable Android’s Accessibility Service under false pretenses, such as solving a network issue or unlocking financial benefits.
With Accessibility access granted, RatHat clicks through system menus to enable Developer Options and Wireless Debugging without requiring a separate computer connection. The malware reads the six-digit ADB pairing code displayed on the screen and connects to the device’s own Android Debug Bridge. From there, RatHat launches a Go-based agent to execute system commands and starts a reverse-proxy client for persistent access. According to Zimperium, the malware sends live screen layouts from Android’s Accessibility tree directly to a generative AI assistant, allowing the program to identify UI elements, read text, and determine when to scroll dynamically.
Cleafy Uncovers Web Console Operations and Gemini AI Victim Sorting
Operators build, host, and control infected phones using a web console distributed through a malware-as-a-service model, security firm Cleafy reported. Cleafy observed nearly 100 console deployments since April 2026, noting that the infrastructure frequently rebuilds the malicious application—such as every hour on Amazon S3 or web servers—to evade static file-hash detection tools. The console stores intercepted text messages and banking credentials captured through fake login screens overlaid on legitimate financial and cryptocurrency apps.
The latest iteration of the RatHat console integrates Google’s Gemini AI to analyze captured messages and estimate individual victim bank balances. Cleafy stated that the AI model is used strictly to sort infected devices into high-value and mid-value groups, helping operators prioritize which victims to target. While early console versions allowed operators to choose from multiple AI providers and sent Telegram alerts upon reaching specific AI score thresholds, the latest version exclusively interfaces with Gemini through Google AI Studio. RatHat also maintains a backup capture method using a screencap tool operating at approximately five frames per second, while the underlying Go program maintains persistence even after the primary application is removed until the device restarts.
Frequently Asked Questions About RatHat Android Malware
How does RatHat infect an Android phone?
RatHat spreads through social engineering tactics such as SMS phishing, deceptive third-party download sites, and malicious advertising. Victims manually install an APK file that mimics a trusted application, such as a streaming platform or Chrome.
What role does generative AI play in the attack?
RatHat uses generative AI in two distinct ways. On the infected device, it queries Gemini to read screen layouts and determine where to tap when using unfamiliar interface versions. On the attacker’s web console, Gemini analyzes intercepted text messages to estimate victim bank balances and sort targets by financial value, according to Cleafy.
How does the malware maintain persistence on a device?
The malware establishes shell-level access via Android Debug Bridge and launches a Go-based reverse-proxy client. Zimperium and Cleafy noted that this background program continues running after the malicious app is deleted, persisting until the phone is restarted.
Worth a look