GoKawiilRatHat Android trojan uses AI to autonomously navigate infected devices, Zimperium finds
Zimperium zLabs identified a new Android malware family, RatHat, spread via malvertising, SMS and phishing sites offering APK downloads outside Google Play. It abuses Accessibility permissions and enables Developer Options and Wireless Debugging to gain shell-level control, installing companion agents that maintain persistence, log keystrokes, and steal banking or crypto credentials through fake overlays. Researchers link the operation to Chinese-speaking actors based on Chinese-language prompts found in its AI automation engine.
GoKawiil's interpretation of the reporting above, not reported fact.
RatHat's use of an AI system to read and act on Android's live Accessibility tree marks a shift toward malware that can adapt its own navigation and actions rather than relying on fixed scripts, making detection and analysis harder. Its dual-agent persistence design, where each component restores the other, shows attackers building resilience against removal attempts, raising the bar for mobile security defenses.
- RatHat is a new Android malware family that uses AI to automate device navigation and control.
- It abuses Accessibility services and ADB access to gain shell-level privileges and steal banking, crypto and OTP data.
- Zimperium ties the malware to Chinese-speaking threat actors based on Chinese-language AI prompts found in its code.
Bitdefender Mobile Security for Android — With Android malware like RatHat exploiting Accessibility permissions and ADB debugging to hijack devices, a dedicated mobile security app can help detect malicious APKs before they gain a foothold. Bitdefender Mobile Security offers real-time scanning and app privacy advisors that flag suspicious sideloaded apps, which is exactly the vector this malware uses to spread.”, so it's a timely safeguard for Android users worried about phishing links and shady APK downloads.
See Bitdefender Mobile Security for Android on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-17
Published there as: “New RatHat Android malware uses AI to automate device control”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.