A newly discovered Android malware called RatHat targets users with an artificial intelligence powered subsystem that helps operators remotely navigate compromised devices. Researchers at Zimperium zLabs analyzed the malware and linked it to threat actors based in China. This conclusion comes after investigators found the malware using large language model prompts written in Chinese. Attackers distribute RatHat through malvertising campaigns, malicious text messages, and phishing websites that promote APK downloads from outside the official Google Play store.
RatHat relies on abusing Android Accessibility permissions to perform highly privileged actions on infected devices. The malware enables Developer Options and Wireless Debugging to gain a local shell level execution context without needing an external computer. This mechanism resembles techniques seen in the ToxicPanda and RedHook Android malware families. Access via Android Debug Bridge lets RatHat install a Go based agent known as liblocal-service.so. This agent runs commands with shell privileges, creates battery restriction bypasses, and manages system persistence.
The Go based agent restores the malware if security tools remove or stop it. This provides a persistence channel that remains independent of the main malware package. The protection operates in both directions, because the malware also restores the agent if that component gets removed. A second agent named libmedia_codec.so operates as a fast reverse proxy client. It establishes a persistent tunnel connecting the infected device directly to the attacker.
The malware deploys HTML overlays designed to mimic targeted banking and cryptocurrency applications. These overlays capture user account credentials entered into the fake login screens. RatHat also intercepts SMS messages and device notifications, including one time security passwords. It records text change events, extracts Uniform Resource Locators from browser address bars, and captures lock screen PINs, passwords, and unlock patterns.
Zimperium reports that RatHat features an artificial intelligence driven user interface automation engine. This engine serializes the live Android Accessibility tree into Extensible Markup Language data. It then transmits that data to a popular artificial intelligence assistant that the research report does not name. This subsystem makes interface automation far more adaptable than traditional methods that rely entirely on fixed scripts. The artificial intelligence integration allows remote navigation without forcing operators to maintain real time interaction.
Zimperium explained that RatHat uses artificial intelligence to intelligently navigate and control device interfaces in real time. This capability makes malicious operations more adaptable and harder for security software to detect than standard scripted automation. The malware actively thwarts removal attempts by intercepting the system uninstall confirmation screen. It cancels the removal procedure and displays a fake Google Play overlay containing a bogus error message to trick the user.
Zimperium highlighted multiple anti analysis techniques embedded within the malware package. These defenses include Android Package Kit container tampering, an unusually bloated 61 megabyte Android manifest file, and invalid Dalvik Executable pseudo instructions. These measures aim to confuse or break security analysis tools and reverse engineering efforts. Security experts advise Android users to avoid downloading application files from outside official app stores unless they explicitly trust the publisher.
Users must avoid granting sensitive Accessibility permissions to untrusted applications and regularly scan their mobile devices using Google Play Protect. The next known step involves security teams monitoring for further developments and analyzing new variants of the RatHat threat family as telemetry data becomes available.
