RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
RATHat Android banking trojan uses Gemini to pair wireless debugging and control phones beyond normal app permissions.
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #rathat
Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks
Cleafy's RATHat Android trojan uses Gemini Flash to navigate UIs and keeps shell persistence after app removal.
1
RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.
RatHat Android Trojan Uses AI for Automation
Zimperium says RatHat, an Android trojan, uses generative AI to control devices and steal banking credentials.
RatHat Turns Android Accessibility Into an Attack Weapon
Zimperium details RatHat, a China-linked Android trojan abusing Accessibility, wireless debugging, and generative AI to steal banking credentials and persist on phones.
5
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Zimperium details RatHat, a China-linked Android malware using smishing, Accessibility abuse, local ADB self-pairing, and generative AI to persist after uninstall and steal data.
2
New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
2
New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data
Zimperium details RatHat, a new Android banking trojan using a generative AI engine to automate credential and OTP theft.
9
New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
2