New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It

A newly tracked Android malware called RatHat is targeting banking customers with fake screens, stolen verification codes and persistent phone access.

The threat can capture PINs, passwords and unlock patterns, raising the risk of account takeovers and payments after a victim believes the malicious app is gone.

The campaign relies on deceptive download pages promoted through text-message phishing, malicious advertising and third-party forums.

Victims are persuaded to install an Android app package that appears legitimate, then guided into granting Accessibility permissions. This route also featured in the recent ToxicPanda banking malware campaign.

Zimperium said in a report shared with Cyber Security News (CSN) that zLabs researchers identified RatHat and linked its operators to actors that appear to be operating in China.

The researchers described an infection chain that turns developer and accessibility functions into tools for remote control. The danger is not limited to a fake login form.

RatHat can watch on-screen activity, intercept SMS messages and notifications containing one-time codes, and collect installed-app data. Its design gives criminals several ways to reach a bank account, while a hidden component works to keep access alive.

New Android Malware Steals Banking PINs and Reinstalls Itself

After receiving Accessibility access, RatHat uses automated taps to enable Developer Options and Wireless Debugging. It reads the pairing code and changing port displayed by Android, then pairs with the phone’s local ADB service.

That process gives the malware shell-level access, which ordinary apps normally do not have. The malware then places two disguised native components in a system directory.

One acts as a local agent that can grant permissions and alter background settings, while the other creates a reverse connection that can expose the device to the operator. The same Wireless Debugging abuse appeared in the RedHook ADB abuse case.

RatHat’s most damaging feature is its ability to survive removal. It can place a false failure screen over the Android uninstall prompt, but researchers said the local agent remains outside the app’s normal lifecycle even if removal succeeds.

It checks whether the package is present, reinstalls the APK when it is missing, and restores permissions without asking again.

That persistence changes a routine cleanup into a harder incident. A user may delete the visible app, yet the attacker can still have shell access and a path to reinstall it.

Organizations handling mobile banking should treat unexpected Accessibility activation or Wireless Debugging prompts as possible signs of compromise.

AI control expands fraud risk

RatHat also uses fake web-based overlays that resemble banking, cryptocurrency and payment applications. When a targeted app opens, the malware can place a convincing screen above it to collect credentials and PINs.

It also monitors touch coordinates through the device input system, allowing it to infer digits on a PIN pad or movements used for a pattern unlock.

Researchers found that the malware sends a live map of the phone interface to a generative AI assistant for narrow automation tasks, such as finding a named button, reading on-screen text, or deciding when to scroll.

This can help it adapt to screens and languages rather than relying on fixed tap locations. Similar remote-control capabilities were documented in the StreamRAT remote control threat.

For users, the practical defense starts before installation. Download apps only from official stores, avoid links in unsolicited messages and ads, and refuse Accessibility access when an app has no clear accessibility purpose.

Review enabled services and Wireless Debugging settings, and contact the bank from a trusted device if unexplained prompts, login screens or account activity appear.

Banks and payment providers should look for sessions from phones showing screen overlays, accessibility scraping or active debugging services, then require extra verification before high-risk transfers.

Users should also avoid relying solely on SMS codes, because RatHat is designed to intercept them. The Manic PIN theft campaign illustrates why tap-based credential theft remains a serious concern for mobile financial security.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	liblocal-service.so	Disguised Go-based local agent used for shell-level commands, persistence, and permission changes
File name	libmedia_codec.so	Disguised Fast Reverse Proxy client used to create a persistent remote tunnel
File path	/data/local/tmp/app.apk	APK path used by the local agent to reinstall RatHat after app removal
File name	local-service.update	Local agent update file staged in /data/local/tmp/
File name	server_config.json	Configuration file used to alter the malware’s launcher appearance
File name	svc_config.html	Local HTML lure used to persuade victims to enable Accessibility access
File name	locateValues.json	File containing device-specific keypad and pattern-lock layout information
IP address and port	127.0.0.1:7910	Local HTTP server started by the RatHat Go agent
File name	cert.pem	Device ADB certificate collected and uploaded by the malware
File name	private.key	Device ADB private key collected and uploaded by the malware

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC