RatHat Android Malware Uses AI To Hijack Phones, Steal Banking Credentials

Security researchers at Zimperium’s zLabs are sounding the alarm over a new breed of malware dubbed RatHat, which malicious actors are using to compromise Android devices. While RatHat makes use of tried-and-true approaches at various stages of an attack, the researchers share that it uses novel persistence techniques while harnessing generative AI for operational control.

To successfully infect a victim’s device, threat actors are relying on methods that have long been used by others. A mix of phishing sites, smishing and posting download links on internet forums is providing ample opportunity for RatHat to spread. Of course, it’s always disguised as a legitimate app to trick users into manually installing it onto their device.

Once installed, it provides a wide suite of tooling to steal a victim’s data. Some of the capabilities include the ability to inject an overlay over apps to steal credentials, recording or taking snapshots of a device’s screen, stealing 2 factor authentication codes by snooping on SMS messages, and can even request admin rights that can be used to wipe a device.


Where this malware stands out from the pack is in its use of generative AI, which is uses to automate several tasks. These include navigating the screen with commands such as “scroll down,” simulating clicks and can ingest any text that happens to be on screen. The researchers don’t specify which AI service attackers are using, though, only referring to it as a “popular Generative AI assistant.”

RatHat deploys a variety of mechanisms to fly under the radar of Android’s security features. This includes utilizing a combination of four anti-analysis layers that make it difficult for the OS or security software to catch it with static or dynamic inspection. Additionally, it’s able to conduct six different runtime checks to ensure that it’s not caught by any debugging processes.

To lessen the risk of running into something like RatHat, users should stick to the Google Play Store when downloading and installing apps. Hopefully these attacks become less common as Google implements its new security policies.