Researchers have uncovered a sophisticated new Android Trojan named RatHat that exploits live AI assistants and accessibility services to bypass security sandboxes, hijack device controls, and steal banking credentials and PINs without hardcoded scripts.
A newly analyzed Android Trojan is changing the mechanics of mobile malware by handing device controls over to a live artificial intelligence assistant. Dubbed RatHat, the threat was uncovered by researchers at Zimperium’s zLabs and detailed extensively by Malwarebytes, revealing an elaborate multi-stage attack chain designed to bypass standard mobile security defenses and harvest sensitive financial data, such as bank logins and PIN codes.
Unlike traditional Trojans that rely on rigid, hardcoded instructions, RatHat incorporates novel techniques for persistence and leverages AI for operational control, according to technical analysis. The malware gives an automated assistant direct access to the accessibility tree of an infected handset. This setup allows the malicious software to determine dynamically where to tap or scroll on screen in real time, making its variable attack paths significantly harder for signature- and rule-based security software to detect.
Smishing Bait and Accessibility Abuse
The infection process starts with traditional social engineering tactics. Attackers lure victims using SMS phishing, commonly known as smishing, alongside malicious advertisements that direct users to fake download pages. These landing pages frequently masquerade as popular streaming applications or familiar web browsers like Chrome, tricking targets into sideloading a malicious Android Package Kit.
Once the APK is installed, the application pressures the user into enabling Android’s Accessibility Service by citing a fake financial incentive or a bogus network restriction issue
. Because accessibility services run quietly in the background and possess the authority to inspect screen contents and interact with applications on behalf of the user, granting this permission hands the malware sweeping operational power.
With accessibility access secured, the Trojan begins silently tapping through the phone’s Developer Options. It turns on Wireless Debugging and reads the six-digit pairing code directly from the screen, pairing with the device autonomously without needing human intervention or an external computer.
This is a known, legitimate Android feature (normally used by app developers to test on a phone over Wi-Fi) that RatHat repurposes for self-escalation.
Malwarebytes, via Malwarebytes and Cyberdaily
That self-pairing mechanism grants the malware a shell-level Android Debug Bridge session, letting it break free from the normal app sandbox. Through this session, the Trojan drops two disguised native binaries: a Go-based agent that executes system commands with elevated privileges, and a reverse-proxy client that establishes a persistent tunnel back to the attacker’s command server while bypassing firewalls and Network Address Translation.
Autonomous Navigation and Credential Theft
The core innovation of RatHat lies in how it interacts with the user interface. Security analysts noted that RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.
By leveraging this live intelligence, RatHat gives a live AI assistant the keys to the accessibility tree of the infected device. This capability enables the malware to determine where to tap or scroll, rather than following a hardcoded script
as it executes its payload.
To capture credentials, the Trojan generates convincing overlays for targeted applications, primarily focusing on financial institutions. These overlays are capable of intercepting one-time passwords and multi-factor authentication codes. Furthermore, the malware records raw touch coordinates directly from the input driver, matching those physical strokes against a database of known keypads and pattern-lock layouts to reconstruct PIN codes and unlock patterns without needing to read the screen text directly.
Defense and Mitigation Strategies
Security researchers emphasize that because RatHat relies heavily on sideloading and social engineering, standard mobile security precautions remain the most effective defense against infection. Users are advised to download applications exclusively from official storefronts like the Google Play Store, which significantly minimizes the risk of encountering malicious APKs.
Experts also warn mobile users to treat any unexpected prompts requesting Accessibility Service permissions, Wireless Debugging, or Developer Options with extreme caution, particularly when requested by utility or streaming apps that have no logical need for them. Google’s Advanced Protection Mode provides an additional safeguard by restricting which applications can request accessibility privileges.
Because RatHat establishes deep system persistence that can survive standard application removal, security advisories note that if your device is infected with RatHat, you will need to perform a factory reset because its persistence mechanism can survive normal app removal. Fortunately, analysts confirmed that no apps containing this malware are found on Google Play.
По теме
