New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
Zimperium zLabs identified RatHat, an Android banking trojan delivered via smishing, malvertising, and third-party forums, linked to actors apparently operating in China. After abusing Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access, it installs a Go-based local agent and a Fast Reverse Proxy client in system directories. It uses fake overlays to steal banking, crypto, and payment credentials, intercepts SMS one-time codes, sends screen maps to a generative AI assistant for adaptive automation, and reinstalls itself via /data/local/tmp/app.apk after uninstall.