RatHat (Organization): news timeline & CVEs

RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model

Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.

Cleafy research published September 28 shows the RatHat implant changed little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop. Nearly 100 deployments since April 2026 support a malware-as-a-service model, with campaigns across Europe, Latin America, and Southeast Asia; almost half of observed IPs sat on one Singapore-based network. The latest panel uses Google Gemini to analyze stolen SMS messages and estimate victims' bank balances, sorting devices into high-value and mid-value groups. Operators can also deploy a native Go service via wireless debugging for shell-level control outside Android's permission model, persisting until reboot.

Infosecurity MagazineSep 29, 14:30 UTC · 13h agoMalware in the wild 2 sources

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.

Cleafy traced nearly 100 deployments of the RatHat Android banking trojan's web console since April 2026, consistent with a malware-as-a-service model spanning Fisher, BlackCat Remote Control Management, and Panda Workshop V5/V6 versions. The console stores stolen SMS and passwords harvested via fake login overlays on banking apps, and its latest version uses Google's Gemini to estimate each victim's bank balance and sort devices into high- and mid-value groups. On-device, the trojan abuses Accessibility access to enable wireless debugging and pair with ADB, yielding a shell running as UID 2000, while a Go program maintains a reverse tunnel and streams the screen via minicap/minitouch without permission prompts. The malware also sends screen layouts to Gemini for tap guidance when built-in instructions fail, mirroring ESET's PromptSpy findings from February.

The Hacker Newsupdated Sep 29, 14:30 UTC · 13h agofirst Sep 28, 17:38 UTC · 1d agoMalware in the wild 2 sources

RatHat

Timeline2 articles

Appears with

RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims