GoKawiilRatHat Android malware uses AI agent to hijack devices via fake Chrome app
Security firm Zimperium has identified RatHat, a new Android malware strain that tricks users into installing a fake app resembling Google Chrome through a spoofed Play Store page. Once granted accessibility permissions, it silently enables developer-level ADB Shell access, deploys an AI-driven agent to run system commands, and funnels stolen data to remote servers. Researchers have already found 162 infected apps tied to roughly a dozen attacker-controlled servers, with China-linked actors primarily targeting payment apps like WeChat Pay and Alipay.
GoKawiil's interpretation of the reporting above, not reported fact.
This attack shows how legitimate developer tools like accessibility services and Wireless Debugging can be weaponized to gain full device control without triggering obvious warning signs. Pairing malware with an AI agent that automates data theft signals a troubling shift toward more autonomous, harder-to-detect mobile threats, and the technique could easily expand beyond Chinese payment apps to other financial services worldwide.
- RatHat exploits accessibility permissions to secretly enable ADB Shell admin access on Android devices.
- An AI-assisted agent within the malware runs commands to steal data and relay it to attacker servers.
- 162 infected apps have been found so far, mainly targeting Chinese payment platforms like WeChat Pay and Alipay.
Bitdefender Mobile Security for Android — With sophisticated malware like RatHat exploiting accessibility permissions to hijack Android devices, having a dedicated mobile security app that scans installed apps and blocks malicious downloads is a smart line of defense. Bitdefender Mobile Security actively monitors app behavior and flags suspicious permission requests, helping you avoid fake Play Store lookalikes before they gain a foothold.
See Bitdefender Mobile Security for Android on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: cnet.com — Joe Hindy, 2026-09-20
Published there as: “Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.