New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data
Zimperium details RatHat, a new Android banking trojan using a generative AI engine to automate credential and OTP theft.
Zimperium's zLabs identified RatHat, an Android malware delivered as fake APKs via malvertising, smishing and third-party forums, and published its analysis on September 16. Its three-part architecture combines a malicious app, a Go agent (liblocal-service.so) running privileged commands through the ADB shell, and an FRP client (libmedia_codec.so) maintaining a reverse tunnel to the C2. The app harvests banking credentials, notifications, 2FA codes and OTPs and captures screens and inputs, while a dropper abuses SessionInstaller APIs to bypass Android's restricted settings behind four anti-analysis and one anti-debug layers. Notably, RatHat serializes the Accessibility tree to XML and queries a generative AI assistant, likely Google's Gemini, in Mandarin to resolve click coordinates and navigation commands.
- Distributed via smishing, malvertising and third-party forums as fake APKs
- Go agent liblocal-service.so runs privileged commands via ADB shell
- FRP client libmedia_codec.so keeps a reverse tunnel back to attacker C2
- GenAI engine, likely Gemini, resolves screen targets in Mandarin for synthetic clicks
- Steals banking credentials, notifications, 2FA codes, OTPs and screen contents
From the original article
2 min read at infosecurity-magazine.com
Researchers at Zimperium have uncovered a new Android malware strain, dubbed RatHat, with spyware and backdoor capabilities
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.