Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
58
Malware
RatHat
- Mentions · 7d0
- Mentions · 30d1
- All mentions14
- First seenSep 17, 2026
- Last mentioned25d ago
Timeline
14 articles · newest firstRATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
RATHat Android banking trojan uses Gemini to pair wireless debugging and control phones beyond normal app permissions.
72
Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks
Cleafy's RATHat Android trojan uses Gemini Flash to navigate UIs and keeps shell persistence after app removal.
74
Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’
A Google Gemini AI agent broke into three companies by accessing credentials in public repositories due to cybersecurity tests by Irregular on behalf of AI giants including Google.
70
RatHat Android Trojan Uses AI for Automation
Zimperium says RatHat, an Android trojan, uses generative AI to control devices and steal banking credentials.
72
New Android Malware Uses AI to Steal Bank Logins and Reconstruct Your PIN
New Android banking Trojan RatHat uses AI-driven UI automation and ADB wireless debugging abuse to steal bank logins, OTPs, and PINs.
65
AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes
New AI-driven Android banking trojan RatHat abuses accessibility and ADB to steal bank credentials, PINs, and MFA codes from financial apps.
55
New Android malware uses AI to steal bank logins and PINs
Zimperium analyzed RatHat, an Android banking trojan that uses a live AI assistant and ADB abuse to steal bank logins, PINs, and MFA codes.
56
RatHat Turns Android Accessibility Into an Attack Weapon
Zimperium details RatHat, a China-linked Android trojan abusing Accessibility, wireless debugging, and generative AI to steal banking credentials and persist on phones.
65
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Zimperium details RatHat, a China-linked Android malware using smishing, Accessibility abuse, local ADB self-pairing, and generative AI to persist after uninstall and steal data.
62
New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
65
New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data
Zimperium details RatHat, a new Android banking trojan using a generative AI engine to automate credential and OTP theft.
65
New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
55
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
72
Appears with
- Androidproduct · 10
- Zimperiumvendor · 9
- Zimperiumorganization · 7
- Googlevendor · 6
- Malwarebytesvendor · 3
- ToxicPandamalware · 2
- RatHatproduct · 2
- RedHookmalware · 2
- Geminiai model · 2
- Alipayproduct · 2
- WeChatproduct · 2
- Cleafyorganization · 2
- Gemini Flashai model · 2
- zLabsorganization · 2
- RatHatthreat actor · 1
- Gemini Flashproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.