New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
65
Malware
ToxicPanda
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 20, 2026
- Last mentionedSep 17, 2026
Timeline
5 articles · newest firstNew Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
55
ToxicPanda Banking Trojan Matures Into Enterprise Threat
The ToxicPanda Android banking trojan has matured with new features that expand its global reach beyond users' financial apps.
48
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
65
Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps
Zimperium reports ToxicPanda 2.0, an updated Android banking trojan now targeting more than 140 banking and cryptocurrency apps.
55
Appears with
- Zimperiumvendor · 4
- RedHookmalware · 2
- Zimperiumorganization · 2
- RatHatmalware · 2
- zLabsorganization · 1
- Androidproduct · 1
- ToxicPandaproduct · 1
- RatHat operators (suspected Chinese)threat actor · 1
- StreamRATmalware · 1
- RatHatproduct · 1
- Cleafyorganization · 1
- Googlevendor · 1
- Google Playproduct · 1
- Google Play Protectproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.