RatHat Android Trojan Uses AI for Automation

A newly discovered Android trojan relies on generative AI to more intelligently navigate and control the infected devices, mobile security company Zimperium reports.

Dubbed RatHat, the malware has been distributed through smishing and malvertising, relying on an automated multi-stage infection pipeline to break out of Android’s application sandbox and gain shell-level execution.

RatHat contains typical mobile malware capabilities: it steals users’ credentials, mimics banking and payment applications to steal credentials and access codes, and establishes a covert communication channel with the command-and-control (C&C) server for remote access.

Unlike other mobile threats, however, it also uses generative AI to navigate and control the device’s interface in real time, and monitors users’ input at the hardware level to reconstruct PIN codes, passwords, and patterns. It also grants itself administrator-level permissions to access system functions, and installs a separate hidden background service to reinstall itself and restore its permissions.

The AI prompts used by the malware suggest it was developed by a Chinese threat actor.

RatHat, Zimperium says, is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions. Its architecture consists of three parts: a malicious Android application, a Go agent, and an FRP client.

The application gains critical system permissions, bootstraps the infection chain, and provides an interface with the user. It contains a dynamic configuration that allows its operators to enable different activity aliases.

It also uses a localized HTML lure to gain access to the Accessibility Services and elevate its privileges. It contains an advanced WebView overlay injection engine to serve fake interfaces of popular apps, captures the device’s screen and user input, intercepts SMS messages, and requests Device Admin rights, which allow it to wipe the device.

A particularly unique feature of RatHat is its communication with a generative AI assistant, which it uses for non-malicious actions after it serializes the device’s live Accessibility tree to XML.

The AI reads on-screen content and layout to automatically navigate and interact with the device.

After gaining a shell via the local ADB daemon, the malware drops and executes an agent written in Go. It functions as the C&C brain of RatHat, executing commands and gaining system-level persistence and power management exemptions.

Derived from fatedier/frp, the third malware component is a reverse-proxy client, frpc, that establishes a secure, persistent reverse tunnel, giving attackers access to the ADB daemon for command execution.

RatHat can intercept and cancel uninstallation attempts. Even if the user removes the malware, its shell service remains on the device, periodically checks whether the application is still available, and reinstalls it if not.

The malware implements keylogging through three specialized mechanisms: it monitors accessibility text-change events to reconstruct what the user typed, reads browser address bars by resource ID, and the Go agent can record, at the hardware level, where the user’s finger touched the screen.

The Go agent abuses its execution in a shell environment to use the standard Android debugging tool getevent to read the raw device file the kernel writes to, extracting raw event coordinates and comparing them against the keypad layout.

Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews

Related: New BTMOB Android Malware Enables Full Device Takeover

Related: Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

Related: North Korean Hackers Deploy New Linux Espionage Toolkit