AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes
New AI-driven Android banking trojan RatHat abuses accessibility and ADB to steal bank credentials, PINs, and MFA codes from financial apps.
55
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 22, 2026
- Last mentionedSep 19, 2026
Timeline
5 articles · newest firstRatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
72
Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.
46
MantaxOtax Android Malware Combines Ransomware With Spyware
Zimperium analyzed MantaxOtax Android malware combining AES file encryption with extensive spying, linked to Indonesian actors and distributed via sideloading.
45
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
65
Appears with
- Zimperiumvendor · 4
- Zimperiumorganization · 3
- Indonesian threat actorsthreat actor · 2
- RatHatmalware · 2
- MantaxOtaxmalware · 1
- Cleafyorganization · 1
- Androidvendor · 1
- ToxicPandamalware · 1
- WeChatproduct · 1
- Google Play Protectproduct · 1
- Firebaseproduct · 1
- Androidproduct · 1
- Mantax OTAXmalware · 1
- Alipayproduct · 1
- Malwarebytesvendor · 1
- THost9malware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.