New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
65
Malware
RedHook
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 17, 2026
- Last mentionedSep 17, 2026
Timeline
2 articles · newest firstNew Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
55
Appears with
- Zimperiumvendor · 2
- ToxicPandamalware · 2
- RatHatmalware · 2
- Googlevendor · 1
- Google Playproduct · 1
- Androidproduct · 1
- RatHat operators (suspected Chinese)threat actor · 1
- Zimperiumorganization · 1
- StreamRATmalware · 1
- RatHatproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.