RatHat Android Banking Trojan Chains Accessibility and Wireless Debugging for ADB Shell Access, Uses Generative AI (Likely Gemini) to Steal PINs and OTPs, and Reinstalls Itself…

Zimperium zLabs (analysis published September 16, per Infosecurity Magazine) identified RatHat, a China-linked Android banking trojan that abuses Accessibility permissions to enable Wireless Debugging and obtain a local ADB shell without a host computer. A Go…

Zimperium's zLabs research team has published analysis (dated September 16, per Infosecurity Magazine) of RatHat, an Android banking trojan attributed to actors apparently operating in China. The sideloaded fake APK is delivered via smishing, malvertising, and third-party forums (GBHackers also cites HTML overlays as a delivery/overlay mechanism). RatHat has a three-part architecture (per Infosecurity Magazine): a malicious app, a Go agent (liblocal-service.so) running privileged commands through the ADB shell, and an FRP (Fast Reverse Proxy) client (libmedia_codec.so) maintaining a reverse tunnel to attacker C2. The app abuses Accessibility permissions to enable Wireless Debugging and pair with a local ADB instance, yielding shell access without a host computer; masqueraded Go binaries in /data/local/tmp grant exemptions, disable packages, and provide persistence, while a dropper abuses SessionInstaller APIs to bypass Android's restricted settings. Credential theft combines fake/HTML overlays targeting banking, crypto, and payment apps (WeChat and Alipay are named per GBHackers), interception of SMS one-time codes, and harvesting of notifications, 2FA codes, OTPs, and screen contents; a getevent-based collector maps raw touch coordinates to PIN pads and pattern locks using keypad layouts stored in locateValues.json. Distinctively, RatHat serializes the accessibility tree to XML and sends screen maps to a generative AI assistant—likely Google's Gemini, queried in Mandarin—to resolve click coordinates and navigation commands for adaptive on-screen automation and data extraction. It survives uninstall: a resident shell-level local service reinstalls the APK from /data/local/tmp/app.apk and restores permissions automatically. Anti-analysis defenses include malformed DEX, a padded manifest, and debugger, Frida, and emulator checks (GBHackers); Infosecurity characterizes these as four anti-analysis layers plus one anti-debug layer. Cyber Security News notes similar Wireless Debugging abuse in RedHook and a similar accessibility route in ToxicPanda.

• RatHat is an Android banking trojan analyzed by Zimperium zLabs; Zimperium published its analysis on September 16 (per Infosecurity Magazine).
• Attributed to actors apparently operating in China (Zimperium and zLabs, per all three reports).
• Delivered as fake APKs via smishing, malvertising, and third-party forums; GBHackers additionally cites HTML overlays.
• Abuses Accessibility permissions to enable Wireless Debugging and pair with a local ADB instance, obtaining shell access without a host computer.
• Three-part architecture (Infosecurity Magazine): malicious app, Go agent liblocal-service.so running privileged commands via the ADB shell, and FRP client libmedia_codec.so maintaining a reverse tunnel to attacker C2.
• Masqueraded Go binaries in /data/local/tmp grant exemptions, disable packages, and provide persistence (GBHackers).
• Dropper abuses SessionInstaller APIs to bypass Android's restricted settings (Infosecurity Magazine).
• getevent-based collector maps raw touch coordinates to PIN pads and pattern locks using keypad layouts stored in locateValues.json (GBHackers).