Discovered by Zimperium researchers, a sophisticated new Android malware strain named RatHat uses generative AI and local ADB self-pairing to bypass sandbox restrictions, harvest financial data, and retain shell-level persistence on compromised devices even after a user attempts to uninstall the malicious application.
A sophisticated new digital threat named RatHat has emerged within the Android ecosystem, deploying a multi-tiered architecture that combines accessibility abuse, local self-pairing, and generative artificial intelligence. Security researchers at Zimperium initially flagged the malware, linking its operations to China-based threat actors targeting credential and bank detail harvesting.
How RatHat Infects Devices and Bypasses Security Defenses
The infection chain begins when users are lured into downloading malicious Android package kits through deceptive phishing sites, SMS text phishing (smishing) campaigns, malvertising, and third-party forums. These dropper packages mimic popular legitimate software, such as Google Chrome, using deceptive web pages that imitate the official Google Play Store.
Once deployed, the malware relies on a dropper carrying two encrypted assets. It exploits native SessionInstaller APIs to bypass Android’s restricted settings and Accessibility Service protections. Before executing its main payload, the malware incorporates four anti-analysis layers and one anti-debug check designed to evade traditional inspection. These evasion mechanisms include container tampering, a manifest bomb featuring undocumented chunk headers in AndroidManifest.xml
designed to crash automated analysis pipelines, DEX bytecode poisoning, and dual string-encryption using a scheme called StringCrypto: Base64.
Generative AI and ADB Shell-Level Persistence
RatHat’s core architecture divides responsibilities across three primary operational components: the malicious Android application, a Go Agent masquerading as a native library (liblocal-service.so
), and an FRP reverse-proxy client. The malicious app acts as a conduit to acquire critical system permissions, unlocking Developer Options, enabling Wireless Debugging, and extracting the 6-digit ADB pairing code. By pairing accessibility abuse with autonomous local ADB self-pairing, the malware breaks out of the standard Android application sandbox to execute daemons with shell-level privileges.
A particularly notable feature of the Android application is its generative AI user interface-automation engine. The malware serializes the target device’s live Accessibility tree to XML and communicates in Mandarin with a prominent generative AI assistant—with research graphs indicating the use of Google’s Gemini models. The AI handles non-malicious tasks such as resolving named target centre coordinates on the screen as JSON to direct synthetic clicks, resolving on-screen text from XML, and signaling navigation commands like SCROLL_DOWN
.
Meanwhile, the Go Agent executes commands through the local ADB shell context to bypass app-level restrictions, handling tasks such as exempting the app from battery optimization and Doze mode, prioritizing background execution, and uninstalling security packages. Simultaneously, the FRP client establishes a persistent reverse tunnel back to the attacker’s command-and-control server. This setup grants attackers ongoing remote access to the device’s ADB daemon, acting as a general-purpose backdoor.
Targeted Data Theft and Removal Challenges
The malware’s capabilities extend to capturing banking credentials, notifications, two-factor authentication codes, one-time passwords, and SMS messages. It can also record the screen using Android’s MediaProjection API, capture raw touch input to recreate PIN and pattern unlock codes, and log keystrokes, including URLs entered into browser address bars. Attackers have primarily targeted popular payment applications such as WeChat Pay and Alipay, alongside other financial platforms.
Because the malware utilizes out-of-lifecycle daemons and independent native processes via ADB, simply uninstalling the visible application fails to eliminate the threat. The local service retains shell access, allowing attackers to check if the malware is present and automatically reinstall it if missing. Security experts advise that removing RatHat entirely requires a complete factory reset of the compromised device.
Security analysts emphasize that traditional, signature-based mobile security controls remain insufficient against RatHat’s multi-tiered architecture. To mitigate the risk, users are advised to avoid clicking unverified links in text messages or emails, stick strictly to official app distribution channels like the Google Play Store, and deny accessibility permissions to unverified applications.