New Android Malware Uses AI to Steal Bank Logins and Reconstruct Your PIN
New Android banking Trojan RatHat uses AI-driven UI automation and ADB wireless debugging abuse to steal bank logins, OTPs, and PINs.
Zimperium's zLabs analyzed RatHat, an Android banking Trojan distributed via SMS phishing and malicious ads pointing to fake app download pages. It abuses Accessibility Services to enable Wireless Debugging, pairs via ADB, and drops a Go-based agent plus a persistent tunnel to attacker infrastructure. It overlays fake screens on banking apps, intercepts SMS codes, and reconstructs screen-lock PINs or patterns from raw touch coordinates recorded via the input driver. Malwarebytes highlighted its use of a live AI assistant to decide where to tap or scroll, weakening signature-based detection.
- Distributed via SMS phishing and malvertising leading to sideloaded APKs.
- Uses Accessibility Service abuse to enable Wireless Debugging and self-pair over ADB.
- Drops a Go-based agent and persistent tunnel surviving network barriers.
- Records raw touch coordinates to reconstruct PINs and unlock patterns.
- Hidden component restores the app after removal; factory reset recommended.
- ATT&CK
- T1566.002 Spearphishing LinkT1417.002 Input Capture: GUI Input CaptureT1409 Stored Application DataT1636.001 Protected User Data: CalendarT1657 Financial Theft
- Vendors
- MalwarebytesZimperium
- Products
- Android
- Malware
- RatHat
From the original article
3 min read at cybersecuritynews.com
A newly identified Android banking Trojan called RatHat uses phone features for account theft. The malware can guide itself through an infected device, capture banking logins, intercept verification codes and reconstruct a victim’s screen-lock PIN or pattern. The campaign begins with deception rather than a software flaw.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.