← Back to articles

New RatHat Android malware uses AI to automate device control

2026-09-17 | original

read original get Bitdefender Mobile Security for Android → more articles

Why This Matters

RatHat marks a notable escalation in Android malware sophistication by integrating AI-driven UI automation to let attackers remotely navigate infected devices with less manual effort, potentially making mobile banking and crypto theft attacks faster and more scalable. This signals a broader trend of threat actors weaponizing AI to automate exploitation, raising the stakes for mobile security teams and everyday users who sideload apps outside official stores.

Key Takeaways

RatHat abuses Android Accessibility permissions and ADB/wireless debugging to gain deep, persistent control of infected devices without needing a connected computer.
The malware uses an AI subsystem that reads the Accessibility tree to autonomously navigate the UI, and researchers found Chinese-language LLM prompts suggesting a China-linked origin.
It steals banking/crypto credentials via overlays, intercepts SMS/OTPs and notifications, logs keystrokes, and maintains resilience through dual self-healing agents that reinstall each other if removed.

Worth a Look

Bitdefender Mobile Security for Android — With Android malware like RatHat exploiting Accessibility permissions and ADB debugging to hijack devices, a dedicated mobile security app can help detect malicious APKs before they gain a foothold. Bitdefender Mobile Security offers real-time scanning and app privacy advisors that flag suspicious sideloaded apps, which is exactly the vector this malware uses to spread.”, so it's a timely safeguard for Android users worried about phishing links and shady APK downloads.

See Bitdefender Mobile Security for Android on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese.

The researchers say the malware is distributed through malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play.

Like most Android malware families, RatHat relies on abusing Android's Accessibility permissions to perform highly privileged actions on infected devices.

Most notably, it enables Developer Options and Wireless Debugging to gain a local shell-level execution context without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families.

ADB access lets RatHat install a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, creates battery-restriction bypasses, and manages persistence.

The same agent also restores the malware if it's removed or stopped, providing a persistence channel independent of the malware itself. This back-up goes both ways, with the malware restoring the agent if it's removed.

The Go agent's keylogging activity

Source: Zimperium

A second agent (libmedia_codec.so) also acts as an FRP reverse-proxy client, establishing a persistent tunnel to the attacker.

... continue reading

Explore topics: rathat android malware zimperium zlabs adb shell ai-powered malware