Security researchers at Zimperium have identified an Android threat called RatHat that uses generative AI to steal banking credentials, intercept authentication codes, and reconstruct PINs from touch coordinates. The malware abuses Android's Accessibility Service and Android Debug Bridge (ADB) to gain shell-level control and maintain persistent access to compromised devices.
RatHat primarily spreads through SMS phishing, malicious advertising, and deceptive third-party download sites. The malicious APK often poses as familiar software, such as a streaming app or Chrome, to encourage users to sideload it outside the Google Play Store. Once installed, the malware tricks users into enabling the Accessibility Service by claiming it will resolve network issues or unlock financial benefits. This permission allows the app to inspect screen content and interact with the interface, enabling RatHat to navigate Android settings without user intervention.
The attack chain proceeds by enabling Developer Options and Wireless Debugging. RatHat reads the six-digit ADB pairing code displayed on the phone and connects to the device's own Android Debug Bridge. This process establishes shell-level access outside the normal Android app sandbox, allowing the malware to launch a Go-based agent for system commands and a reverse-proxy client for persistent attacker connection. Zimperium notes that this connection can survive even after the malicious app is removed.
A key differentiator of RatHat is its integration of generative AI. The malware sends data from Android's live Accessibility tree to an AI assistant, which helps determine item locations, read displayed text, and guide scrolling. This makes the attack more adaptable than fixed-sequence automation. After gaining access, RatHat displays fake screens over legitimate banking and cryptocurrency applications, including payment services like WeChat and Alipay, to trick users into entering credentials into attacker-controlled overlays. The malware also intercepts SMS messages and notifications to capture one-time passwords and two-factor authentication codes.
RatHat can reconstruct PINs and pattern locks by monitoring raw touch coordinates and comparing them against known keypad layouts. Because this technique reads touch data at a low level, standard protections that hide PIN digits from screen readers do not prevent this form of theft. To ensure persistence, the malware interferes with uninstall processes by displaying fake Google Play error messages and can request Device Admin rights to wipe the device if removal is attempted. A separate native service launched by RatHat can reinstall the malware and restore permissions after the visible app is deleted.
Google stated that based on current detection, no apps containing RatHat are found on Google Play. The company confirmed that Android users are automatically protected against known versions of the malware by Google Play Protect, which is enabled by default on devices with Google Play Services. Zimperium recommends that users avoid sideloading APKs from untrusted sources, keep Wireless Debugging disabled, and review Accessibility permissions regularly. If a device is confirmed infected with RatHat, a factory reset is advised over a standard uninstall due to the malware's persistent background components.