RatHat Turns Android Accessibility Into an Attack Weapon
Zimperium details RatHat, a China-linked Android trojan abusing Accessibility, wireless debugging, and generative AI to steal banking credentials and persist on phones.
Zimperium analyzed RatHat, an Android trojan from China-based operators distributed via fake app stores through malvertising, smishing, and third-party forums. It abuses Accessibility Services to silently enable wireless debugging, reads the on-screen ADB pairing code to self-pair, and drops Go binaries including an FRP reverse proxy that exposes the phone's ADB shell to remote attackers. It captures credentials via accessibility keylogging, fake overlays on banking apps, WeChat, and Alipay, SMS 2FA interception, and a /dev/input hardware-level keylogger, while sending accessibility-tree XML to a popular generative AI assistant for resilient screen automation and reinstalling itself if uninstalled.
- Distributed via fake app stores through malvertising, smishing, and third-party forums
- Abuses Accessibility to enable wireless debugging and read ADB pairing codes
- Drops Go binaries including an FRP proxy exposing ADB shell to the internet
- Sends accessibility tree XML to a generative AI assistant for screen automation
- Serves overlays on banking apps, WeChat, Alipay; intercepts SMS 2FA codes
- ATT&CK
- T1566.002 Spearphishing LinkT1027 Obfuscated Files or InformationT1056.001 KeyloggingT1656 ImpersonationT1219 Remote Access Software
- Vendors
- Zimperium
- Threat actors
- China-based operators
- Malware
- RatHat
- Organizations
- Zimperium
- Countries
- China
- AI models
- Generative AI assistant (unnamed)
From the original article
5 min read at securityaffairs.com
RatHat combines AI-driven screen control, Android debugging abuse and advanced credential theft to give attackers deep control of infected phones. RatHat is the new Android trojan you should know about. Zimperium researchers just published a breakdown of a strain they’ve traced to China-based operators, and what makes it different isn’t the credential theft, which is […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.