Malware

RatHat

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 17, 2026 · last 3h ago

Timeline2 articles

New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It

Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.

Zimperium zLabs identified RatHat, an Android banking trojan delivered via smishing, malvertising, and third-party forums, linked to actors apparently operating in China. After abusing Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access, it installs a Go-based local agent and a Fast Reverse Proxy client in system directories. It uses fake overlays to steal banking, crypto, and payment credentials, intercepts SMS one-time codes, sends screen maps to a generative AI assistant for adaptive automation, and reinstalls itself via /data/local/tmp/app.apk after uninstall.

Cyber Security News08:55 UTC · 3h agoMalware in the wild 2 sources

RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.

Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.

GBHackersupdated 08:55 UTC · 3h agofirst 08:01 UTC · 3h agoMalware in the wild 2 sources

Appears with

malware RedHook 1 malware StreamRAT 1 malware ToxicPanda 1 organization Zimperium 1 organization zLabs 1 product Alipay 1 product RatHat 1 product WeChat 1 vendor Android 1 vendor Zimperium 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.