New RatHat Android malware uses AI to automate device control

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese.

The researchers say the malware is distributed through malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play.

Like most Android malware families, RatHat relies on abusing Android's Accessibility permissions to perform highly privileged actions on infected devices.

Most notably, it enables Developer Options and Wireless Debugging to gain a local shell-level execution context without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families.

ADB access lets RatHat install a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, creates battery-restriction bypasses, and manages persistence.

The same agent also restores the malware if it's removed or stopped, providing a persistence channel independent of the malware itself. This back-up goes both ways, with the malware restoring the agent if it's removed.

A second agent (libmedia_codec.so) also acts as an FRP reverse-proxy client, establishing a persistent tunnel to the attacker.

The malware displays HTML overlays for targeted banking and cryptocurrency applications to capture account credentials.

It can also intercept SMS messages and notifications, including one-time passwords; record text-change events; extract URLs from browser address bars; and capture lock-screen PINs, passwords, and unlock patterns.

AI-guided navigation

Zimperium reports that RatHat uses an AI-powered user interface-automation engine that serializes the live Android Accessibility tree into XML and sends it to a popular AI assistant not named in the report.

The AI tool is then tasked with:

• Identifying the center coordinates of a named interface element
• Determining an element's actual on-screen text
• Returning navigation instructions such as 'SCROLL_DOWN' and others

This AI-powered subsystem makes RatHat's interface automation more adaptable than automation based entirely on fixed scripts, allowing remote navigation without requiring the operators to perform real-time interaction.

"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," comments Zimperium.

The researchers warn that RatHat will actively thwart removal attempts by intercepting the uninstall confirmation screen, canceling the procedure, and displaying a fake Google Play overlay containing a bogus error message.

Zimperium also highlights multiple anti-analysis techniques embedded in the malware, including APK container tampering, a bloated (61MB) Android manifest file, and invalid DEX pseudo instructions, all aimed at confusing or breaking analysis tools.

Android users should never download APK files from outside Google Play unless they explicitly trust the publisher, avoid granting Accessibility permissions to apps, and regularly scan their devices with Play Protect.