RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions

RATHat Android malware uses Gemini AI to help take control of infected phones beyond normal app permissions. The banking trojan abuses a developer feature to establish a separate command channel that can survive removal of the malicious application until the phone reboots.

Attackers distribute it through malicious adverts and phishing text messages targeting Europe, Latin America and Southeast Asia.

Fake apps lure victims into granting Accessibility access, extending the risks described in earlier RatHat banking attacks with deeper control over the device. Cleafy researchers identified three generations of the malware’s operator panel between April and September 2026.

Samples from late 2025, February 2026 and current campaigns retained a similar design, while the infrastructure behind them changed substantially. Earlier campaigns used cryptocurrency trading and adult entertainment decoys.

Cleafy said in a report shared with Cyber Security News (CSN) that nearly 100 separate deployments had appeared since April 2026.

Licensing restrictions and parallel campaigns support a malware-as-a-service model, rather than proving one central group controls every deployment.

RATHat Android Malware

After receiving Accessibility access, RATHat navigates the phone’s settings, enables wireless debugging and reads the pairing code displayed on screen. It pairs with the local Android Debug Bridge service, gaining access as the shell user, identified by Android as UID 2000.

The pairing process relies on finding specific controls, but fixed instructions can fail on unfamiliar manufacturer interfaces, Android versions or languages. When that happens, the malware sends Gemini a structured description of the live interface and asks where to tap.

Gemini returns coordinates or short text that helps resolve an unfamiliar label. Requests go directly from the phone to Gemini Flash models using a key stored in the malware configuration, rather than passing through the attackers’ command server.

This resembles the adaptive navigation seen in Gemini assisted Android spyware that replaces rigid screen instructions with model responses.

In RATHat, however, the observed device-side AI function specifically keeps the wireless-debugging pairing sequence working when ordinary text matching fails.

Once pairing succeeds, an operator can deploy a separate service written in Go with one click. It runs independently of the app, opens a local HTTP server on port 7912 and remains reachable through a reverse tunnel to the attacker’s infrastructure.

The service can capture screen content and inject touches using Android testing tools without the usual screen-recording prompt or indicator.

Cleafy noted that those tools do not work on Android 14 and later, leaving newer devices dependent on app-based capture with user consent.

Fraud Infrastructure

The command panel evolved from BlackCat into Panda Workshop V5 and V6. V5 introduced operator two-factor authentication and an AI balance-scoring widget, while V6 obscured its frontend code, added phishing download-page templates and consolidated AI settings around Gemini.

Operators can build, package, sign and publish malicious apps without leaving the console. Scheduled rebuilding produces fresh files while keeping the underlying implant unchanged, helping campaigns evade detection methods that depend on recognizing previously recorded file hashes.

Alongside remote control, the panel exposes stolen messages, credentials, contacts, photographs and files. Fake screens placed over targeted apps capture entered information.

Similar ToxicPanda wireless debugging abuse shows why this developer feature has become a concern beyond conventional credential theft.

A separate AI function analyzes collected SMS messages to estimate victims’ bank balances and rank devices by value. It helps operators select targets, rather than carrying out fraud itself.

Cleafy found no analyzed sample that used AI-guided navigation to complete a fraudulent transfer. Cleafy recommends monitoring activity executed as UID 2000, extending security checks beyond the application’s permissions and lifecycle.

Downloaded testing tools retain recognizable filenames in the temporary deployment directory, providing artifacts that investigators can examine during a suspected compromise.

The removal gap is important: deleting the visible app does not immediately stop the independent service, which survives until reboot. The research also warns that AI-assisted interface navigation could reduce the custom engineering needed for future automated banking attacks, although that broader capability was not demonstrated here.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	admin.chunhuating[.]best	September 2026 command-and-control infrastructure, Panda Workshop V6.
Domain	admin.xiongmaocs[.]pics	August 2026 command-and-control infrastructure, Panda Workshop V5.
IPv4	8.231.120[.]246	April 2026 command-and-control infrastructure, BlackCat.
Domain	admin.rathat[.]live	December 2025 and February 2026 command-and-control infrastructure, Fisher.
URL	https://dramaspoolcoa[.]com/en.html	September 2026 delivery page.
MD5	116346cace7f00ba557034b534d40791	September 2026 malware sample.
URL	https://rathat[.]me/app-release-rat-hat-live.apk	December 2025 and February 2026 delivery URL.
MD5	8fdc21e25097a46528211274e54330e1	February 2026 malware sample.
MD5	f83357b2d47c7d38ee53943373961211	December 2025 malware sample.
File name	app-release-rat-hat-live.apk	Android package filename appearing in the source’s delivery URL.
File path	/data/local/tmp	Deployment directory for the native service and downloaded tools; not inherently malicious.
File name	minicap	Legitimate Android testing tool abused for screen capture; not a unique malware indicator.
File name	minitouch	Legitimate Android testing tool abused to inject touch events; not a unique malware indicator.
File name	screencap	Android screen-capture utility used as a fallback; not a unique malware indicator.
URI path	/api/bin/arm64-v8a/minicap	Example command-server path used to retrieve an architecture-specific screen-capture tool.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC