Security researchers at zLabs, a division of Zimperium, have identified a new Android trojan named RatHat. This malware primarily targets Chinese-speaking users and is distributed through fraudulent applications. Once installed, the trojan utilizes Android accessibility permissions to gain deep control over the infected device.
The trojan features an AI-driven recognition mechanism that analyzes the device interface in real-time. It captures screen data in XML format and sends it to an unnamed popular AI assistant. The AI model identifies UI elements, reads text, and provides navigation commands, such as scrolling, to help attackers operate the device remotely.
RatHat is designed to steal sensitive data by displaying fake HTML overlays on financial apps to capture credentials. It intercepts SMS messages and notifications, logs text changes, extracts URLs from browsers, and records lock screen PINs and patterns. The malware also prevents its own uninstallation by intercepting the process and displaying fake error messages.
To evade detection and analysis, RatHat includes anti-analysis features such as modified APK containers and a 61MB Android Manifest file. It also incorporates invalid DEX pseudo-instructions to disrupt security tools. These methods make it more difficult to detect compared to traditional automated scripts.
