RatHat Android Trojan Uses AI for Automation
Zimperium says RatHat, an Android trojan, uses generative AI to control devices and steal banking credentials.
Zimperium describes RatHat, an Android trojan distributed through smishing and malvertising that uses a multi-stage infection chain to leave the app sandbox and gain shell execution. It overlays banking and payment apps, captures the screen and SMS messages, logs input, and reconstructs PINs from hardware touch events, while a generative AI assistant navigates the device from its live accessibility tree. After reaching the local ADB daemon, a Go agent and an FRP-based reverse-proxy client provide persistent remote access, and a hidden service can reinstall the app if removed. Zimperium says the AI prompts suggest a Chinese developer.
- Spread by smishing and malvertising through a multi-stage dropper.
- Overlays, screen capture, SMS theft, and hardware PIN reconstruction.
- Generative AI reads the accessibility tree to navigate the device.
- A Go agent and FRP client open a persistent ADB reverse tunnel.
- A hidden service reinstalls the app after removal attempts.
From the original article
2 min read at securityweek.com
The malware relies on AI for real-time device navigation and control, increasing adaptability and evasion. The post RatHat Android Trojan Uses AI for Automation appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.