Discovered by mobile security firm Zimperium, RatHat is a sophisticated new AI-powered malware targeting Android devices. The threat uses deceptive phishing sites and accessibility abuse to gain admin-level control, running hidden native daemons and generative AI decision loops to harvest sensitive banking and credential data.
How RatHat Infects Android Devices Through Phishing and Deceptive APKs
Security researchers have flagged a dangerous Android malware strain known as RatHat, which is operated by China-based threat actors. The infection pipeline begins long before a user touches their phone settings, relying on targeted SMS phishing (smishing), malvertising, and deceptive third-party forums. These campaigns drive unsuspecting victims to fraudulent download portals designed to mimic the official Google Play Store or distribute malicious Android package kits (APKs). Once downloaded, the application acts as a dropper that carries encrypted assets designed to bypass standard Android application sandboxes.
The malicious payload utilizes native SessionInstaller APIs to slip past restricted settings and Accessibility Service protections. Sav Wheeler, a research engineer for Malwarebytes, noted that the escalation tactic mimics common desktop social engineering schemes. Escalation in the Android landscape often relies on granting apps additional permissions that the OS locks away by default to keep the devices secure,
Wheeler explained via email to CNET.
Four Anti-Analysis Layers and ADB Shell Privilege Escalation
Before executing its primary payloads, RatHat deploys four distinct anti-analysis layers and an anti-debug layer to frustrate automated security pipelines and researchers. According to Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega, these mechanisms include container tampering that declares specific files as directories or sets the ZIP general-purpose encryption bit flag to evade Android’s libziparchive library. The malware also employs a manifest bomb featuring undocumented 0x9999 chunk headers in AndroidManifest.xml, DEX bytecode poisoning with invalid element widths to crash disassemblers, and a Base64-based dual string-encryption scheme called StringCrypto: Base64.
:strip_icc():format(jpeg)/kly-media-production/medias/973802/original/000294100_1441103356-malware_codepolitan.jpg "Photo: liputan6.com")
Once these defenses secure the package against detection, the app exploits accessibility permissions to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code. This autonomous local Android Debug Bridge (ADB) self-pairing breaks the application sandbox completely. The malware then stages independent native daemons that execute with shell-level privileges, allowing attackers to establish deep persistence and apply power management exemptions.
Generative AI Integration for User Interface Automation
Perhaps the most novel characteristic of RatHat is its operational reliance on artificial intelligence. The malware serializes the live Accessibility tree of a compromise target into XML format and communicates with generative AI assistants to automate navigation.
Rather than executing malicious logic, the AI handles standard interface tasks. Investigators observed the Generative AI user interface-automation engine performing non-malicious actions such as resolving a named target’s center coordinates on the screen as JSON to direct synthetic clicks, resolving raw on-screen text from XML trees, and signaling automated navigation commands like SCROLL_DOWN. Network analysis graphs published during the investigation suggest the threat actors utilize Google’s Gemini AI models to direct these interface interactions.
Financial Targeting and Persistent Reverse-Proxy Tunnels
RatHat’s architecture splits operations across a malicious Android application, a Go Agent disguised as a native library (liblocal-service.so), and an FRP reverse-proxy client. The Go Agent communicates with a command-and-control server to fetch tunnel configurations, enabling the FRP client to establish a persistent, active reverse tunnel back to the operator.
“This connection is used by attackers to have access to the ADB daemon: it’s a general-purpose road into the device that carries whatever the operator wants, independent of the malware’s own feature set.”
Zimperium researchers, via The Hacker News
Geographic targeting focuses heavily on Chinese digital ecosystems. Per Zimperium’s tracking, the malware primarily targets financial services such as WeChat Pay and Alipay, alongside other regional applications, with researchers identifying 162 infected apps connected to a dozen operator servers. The spyware features hardware-level keylogging to record finger presses, captures screen inputs via the MediaProjection API, harvests credentials, and intercepts incoming SMS verification messages and two-factor authentication codes.
Why Traditional Security Controls Fail and How Users Can Protect Themselves
Security analysis indicates that traditional signature-based mobile security tools struggle against RatHat due to its dynamic behavior and out-of-lifecycle daemons. Even if a victim attempts to uninstall the primary application package, attackers retain shell access via the local ADB daemon, allowing the local service to check for the malware’s presence and automatically re-install it if not found.
Unfortunately, because of the behavior of the program itself — remasquerading as other apps, dynamically changing its behavior using the AI endpoint — static analysis and quarantining is not enough to remove the malware,
Wheeler noted, emphasizing that a complete factory reset remains the only guaranteed remediation method.
Google confirmed that default protections through Google Play Protect recognize and block the threat, ensuring no verified malicious packages reside on the official app marketplace. Experts advise users to avoid sideloading APKs from unknown sources, verify web address bars to ensure they are inside the genuine Play Store application, and deny accessibility permissions to unverified programs.