Security researchers have discovered RatHat, a new Android malware strain that uses artificial intelligence to navigate infected devices. It can steal banking credentials, intercept passwords and maintain persistent remote access.
RatHat Spreads Through Malicious APK Files
Zimperium zLabs researchers analysed RatHat Android malware after finding it in campaigns that target mobile users.
The operators distribute RatHat through malicious advertisements, SMS messages and phishing websites. These campaigns direct victims to download APK files from outside Google Play.
Researchers found Chinese-language prompts inside the malware’s large language model integration. Therefore, they believe the campaign may have links to threat actors from China.
However, the language alone does not provide definitive proof of the operators’ identity.
Malware Abuses Android Accessibility Services
RatHat relies heavily on Android Accessibility permissions. These services help users interact with their devices, but malicious applications can abuse them to control the interface.
Once a victim grants access, RatHat can perform highly privileged actions. For example, it can monitor interface events, press buttons and navigate between screens.
The malware also enables Developer Options and Wireless Debugging. Consequently, it gains local shell-level access without requiring a connection to an external computer.
Other Android malware families, including ToxicPanda and RedHook, have used similar techniques to obtain shell access through wireless Android Debug Bridge connections.
Go Agent Provides Shell-Level Control
After enabling Android Debug Bridge access, RatHat installs a Go-based agent named liblocal-service.so.
This component runs commands with ADB shell privileges. It also bypasses battery restrictions that could otherwise interrupt the malware’s background activity.
In addition, the agent helps RatHat maintain access to the device. If Android removes or stops the main malware, the agent can restore it.
The same mechanism works in reverse. If someone removes the agent, the main malware can install it again.
This mutual recovery system creates two separate persistence channels. As a result, victims may struggle to remove the infection completely.
Reverse Proxy Creates Persistent Tunnel
RatHat installs a second agent named libmedia_codec.so.
This component operates as an FRP reverse-proxy client. It creates a persistent tunnel between the compromised device and infrastructure controlled by the attackers.
Through this connection, operators can remotely reach the device and issue commands. They can also maintain access even when the victim changes networks.
The proxy therefore strengthens RatHat’s remote-control capabilities and supports long-term surveillance.
RatHat Steals Banking Credentials and Passwords
The malware displays malicious HTML overlays above selected banking and cryptocurrency applications.
These screens imitate legitimate login forms. Consequently, victims may enter usernames, passwords and other account details directly into the attackers’ interface.
RatHat can also intercept SMS messages and notifications. This capability allows it to steal one-time passwords and other security codes.
Furthermore, the malware records text changes and extracts addresses from browser bars. It can also capture lock-screen PINs, passwords and unlock patterns.
Together, these features give attackers access to financial accounts and sensitive personal information. They may also use the stolen credentials to bypass multi-factor authentication.
AI Helps RatHat Navigate Android Interfaces
The AI-powered navigation system distinguishes RatHat from many traditional Android malware families.
RatHat converts the live Android Accessibility tree into XML data. This structure contains information about visible interface elements and their positions.
The malware then sends the data to a popular AI assistant, which the researchers did not identify.
RatHat asks the AI system to locate specific interface elements and calculate their central coordinates. It can also request the actual text displayed on the screen.
Moreover, the AI returns navigation commands, including instructions to scroll through the interface.
This process allows the malware to adapt to changing screen layouts. Traditional automation often depends on fixed scripts and predetermined coordinates.
However, applications can change their interface between versions, screen sizes and languages. Such changes may cause rigid automation scripts to fail.
AI-guided navigation gives RatHat a more flexible way to interact with infected devices. Therefore, operators do not need to control every action manually in real time.
Adaptive Control May Complicate Detection
According to Zimperium, RatHat’s AI subsystem helps it navigate and control interfaces more intelligently.
The technology may also make malicious activity less predictable. Instead of repeating the same fixed sequence, the malware can adjust its actions to the current screen.
As a result, security tools may find it harder to detect RatHat through behavioural patterns alone.
The AI system does not independently compromise the device. Instead, it supports the malware after the victim grants Accessibility access and RatHat establishes its other control mechanisms.
Nevertheless, this integration demonstrates how malware developers can use existing AI services to improve automation.
Malware Actively Blocks Removal Attempts
RatHat Android malware also attempts to prevent victims from uninstalling it.
When the user reaches the uninstall confirmation screen, RatHat intercepts the process and cancels the removal.
It then displays a fake Google Play overlay with a fraudulent error message. This trick may convince the victim that Android could not complete the uninstall process.
Meanwhile, the malware and its Go-based agent can restore one another if the user removes only one component.
RatHat Disrupts Security Analysis
The malware includes several techniques that aim to confuse security researchers and automated analysis tools.
For example, RatHat tampers with its APK container and uses an unusually large Android manifest. The manifest reaches approximately 61MB.
It also includes invalid DEX pseudo-instructions. These features can cause analysis tools to fail or produce unreliable results.
Consequently, researchers may need additional time and specialised methods to examine the malware’s behaviour.
Android Users Should Avoid Untrusted APKs
Android users should avoid downloading APK files from websites, advertisements or unsolicited messages. They should only install external applications when they fully trust the publisher.
Users should also treat requests for Accessibility access with caution. Most everyday applications do not need extensive control over the device interface.
Finally, users should keep Google Play Protect enabled and regularly scan their devices. Anyone who suspects an infection should also review administrator privileges, Accessibility settings and unfamiliar applications.
0 responses to “RatHat Android Malware Uses AI to Control Devices”