New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
Zimperium zLabs identified RatHat, an Android banking trojan delivered via smishing, malvertising, and third-party forums, linked to actors apparently operating in China. After abusing Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access, it installs a Go-based local agent and a Fast Reverse Proxy client in system directories. It uses fake overlays to steal banking, crypto, and payment credentials, intercepts SMS one-time codes, sends screen maps to a generative AI assistant for adaptive automation, and reinstalls itself via /data/local/tmp/app.apk after uninstall.
- Uses Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access.
- Fake overlays capture banking, crypto, and payment credentials, PINs, and patterns.
- Sends screen maps to a generative AI assistant for adaptive task automation.
- Survives uninstall: local agent reinstalls the APK and restores permissions automatically.
- Similar Wireless Debugging abuse seen in RedHook; accessibility route seen in ToxicPanda.
From the original article
4 min read at cybersecuritynews.com
A newly tracked Android malware called RatHat is targeting banking customers with fake screens, stolen verification codes and persistent phone access. The threat can capture PINs, passwords and unlock patterns, raising the risk of account takeovers and payments after a victim believes the malicious app is gone. The campaign relies on deceptive download pages promoted […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.