RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
RATHat Android banking trojan uses Gemini to pair wireless debugging and control phones beyond normal app permissions.
72
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 22, 2026
- Last mentionedSep 30, 2026
Timeline
5 articles · newest firstAndroid Malware Turns Gemini AI Into an Assistant for On-Device Attacks
Cleafy's RATHat Android trojan uses Gemini Flash to navigate UIs and keeps shell persistence after app removal.
74
RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
55
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.
60
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
65
Appears with
- Googlevendor · 2
- Androidproduct · 2
- RatHatorganization · 2
- Zimperiumorganization · 2
- Gemini Flashai model · 2
- RATHatmalware · 2
- PromptSpyorganization · 1
- ToxicPandamalware · 1
- Google Play Protectproduct · 1
- Panda Workshopthreat actor · 1
- Google Geminiorganization · 1
- zLabsorganization · 1
- Panda Workshoporganization · 1
- BlackCatthreat actor · 1
- Android Debug Bridgeproduct · 1
- Googleorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.