The RatHat malware for Android uses an AI-based subsystem to navigate device interfaces in real time. By serializing the Accessibility tree into XML, the malware sends data to an AI assistant to identify UI elements, determine coordinates, and execute navigation commands like scrolling.
Researchers at Zimperium zLabs link the malware to Chinese cybercriminals, noting that the underlying LLM relies on Chinese-language prompts. The software spreads via malicious ads, SMS, and phishing sites that prompt users to download APK files outside of the Google Play Store.
RatHat gains elevated privileges by exploiting Android Accessibility features. It activates Developer Options and Wireless Debugging to establish shell-level access. The malware uses two agents: one for persistence and command execution, and another acting as a reverse proxy client to maintain a tunnel.
The Trojan displays HTML overlays over banking and cryptocurrency applications to steal credentials. It can intercept SMS messages, one-time passwords, PINs, and screen unlock patterns. To prevent removal, the malware intercepts deletion attempts and displays fake error messages.
The malware includes anti-analysis techniques, such as a 61 MB inflated Android manifest file and invalid DEX instructions. Experts advise users to avoid installing apps from untrusted sources, restrict Accessibility permissions, and use security tools like Google Play Protect.
