AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes
New AI-driven Android banking trojan RatHat abuses accessibility and ADB to steal bank credentials, PINs, and MFA codes from financial apps.
Zimperium's zLabs researchers identified RatHat, an Android banking trojan that runs an AI service reading the accessibility tree to automate taps, scrolling, and text input during attacks. It spreads via smishing and malicious ads leading to fake download pages, then abuses Accessibility permissions to enable Wireless Debugging and establish an ADB connection hosting a Go-based agent and reverse proxy. The trojan deploys credential-harvesting overlays mimicking banking interfaces, intercepts SMS one-time passcodes, and reconstructs PINs and unlock patterns from raw touch coordinates. It includes persistence that can survive removal of the visible app, and Malwarebytes reports it specifically targets financial applications.
- AI service reads the Android accessibility tree to automate taps and inputs during attacks
- Smishing and malicious ads redirect victims to fake pages distributing malicious APKs
- Abuses Accessibility permissions to enable Wireless Debugging and establish ADB remote access
- Overlay attacks capture banking credentials while SMS interception grabs MFA codes
- Reconstructs PINs and patterns from raw touch coordinates and includes persistence
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1056 Input CaptureT1219 Remote Access SoftwareT1090 Proxy
- Vendors
- ZimperiumMalwarebytes
- Products
- Android
- Malware
- RatHat
- Organizations
- zLabs
- Countries
- United States
From the original article
2 min read at gbhackers.com
Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malware, which represents a significant evolution in Android threats.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.