New Android malware uses AI to steal bank logins and PINs
Zimperium analyzed RatHat, an Android banking trojan that uses a live AI assistant and ADB abuse to steal bank logins, PINs, and MFA codes.
56
Product
RatHat
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 17, 2026
- Last mentionedSep 18, 2026
Timeline
2 articles · newest firstNew Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
55
Appears with
- Zimperiumvendor · 2
- RatHatmalware · 2
- ToxicPandamalware · 1
- Googlevendor · 1
- Androidproduct · 1
- Malwarebytesvendor · 1
- StreamRATmalware · 1
- RedHookmalware · 1
- Zimperium zLabsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.