New Android malware uses AI to steal bank logins and PINs

Zimperium analyzed RatHat, an Android banking trojan that uses a live AI assistant and ADB abuse to steal bank logins, PINs, and MFA codes.

Zimperium's zLabs analyzed RatHat, an Android banking trojan delivered through smishing texts and malicious ads leading to fake APK download pages disguised as streaming apps or Chrome. After tricking users into granting Accessibility Service access, the malware silently enables Wireless Debugging, reads the on-screen pairing code, and self-pairs via ADB to drop a Go-based agent and a reverse-proxy tunnel that escape the app sandbox. It shows credential-stealing overlays on financial apps, intercepts SMS OTPs and MFA codes, and records raw touch coordinates to reconstruct PINs and pattern unlocks, while a live AI assistant interprets the accessibility tree to decide taps dynamically. A hidden background component reinstalls the app after uninstall, requiring a factory reset to fully remove the infection.