A new Android malware strain called RatHat is turning legitimate Android features into powerful tools for cyberattacks. Discovered by Zimperium’s zLabs researchers, the malware combines Accessibility abuse, Android Debug Bridge (ADB), persistent remote access and generative AI to target banking credentials, payment information and one-time passwords. Researchers say the activity appears linked to threat actors operating from China.
RatHat is primarily distributed through SMS phishing, malicious advertisements and deceptive third-party websites that convince users to download APK files outside official app stores. Once installed, the malware asks victims to enable Android’s Accessibility Service, an important turning point in the attack.
With Accessibility access, RatHat can automatically open Developer Options and Wireless Debugging, retrieve the temporary ADB pairing code and port displayed on the phone, and pair with the device’s local ADB service. This gives it a shell-level execution environment, allowing it to perform actions that would normally be outside the reach of a regular Android application.
The malware then deploys two disguised components. One acts as a local Go-based agent capable of executing commands and maintaining persistence, while another establishes a reverse tunnel to the attackers, giving them a continuing pathway into the compromised device.
RatHat’s data-theft capabilities are equally concerning. It can display fake overlays over banking and cryptocurrency apps to capture credentials and PINs, intercept SMS messages and notifications containing OTPs and 2FA codes, monitor screen activity and collect lock-screen passwords and patterns. It can even analyze raw touch input to reconstruct PINs and unlock patterns.
Adding another layer, RatHat uses AI-assisted interface automation. It can send information about the device’s Accessibility interface to an AI system, which helps identify buttons, read screen text and determine navigation actions such as scrolling. This makes its operations more adaptable than traditional malware relying entirely on fixed scripts
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
