RatHat Malware Uses AI to Steer Compromised Android Phones

A newly identified Android malware family known as RatHat is leveraging artificial intelligence to automate the control of infected devices. According to researchers at Zimperium, the malware uses an AI-powered subsystem to navigate the user interface, allowing remote operators to interact with the phone without needing to be present in real time.

The threat actors behind RatHat appear to be based in China, as indicated by Chinese language prompts found within the code. The malware is typically distributed through malicious advertisements, SMS messages, and phishing sites that prompt users to download application packages from sources other than the official Google Play Store.

Deep system access via developer tools

RatHat exploits Android Accessibility permissions to perform privileged actions on the device. A key feature of the malware is its ability to enable Developer Options and Wireless Debugging. This allows the malware to gain a local shell-level execution context without requiring an external computer to be connected.

Once this access is established, the malware installs a Go-based agent that runs commands with high privileges. This agent can bypass battery restrictions and manage persistence. Crucially, it also acts as a backup mechanism; if the main malware is removed or stopped, the agent can restore it, and vice versa, creating a resilient loop that is difficult to break.

AI navigation enhances stealth and adaptability

The distinguishing feature of RatHat is its use of an AI engine to automate interface interactions. The malware serializes the live Android Accessibility tree into XML and sends it to an AI assistant. The AI then identifies the coordinates of specific interface elements and provides navigation instructions, such as scrolling or tapping.

This approach makes the malware more adaptable than traditional scripted automation. Because the AI can interpret the current state of the screen, it can navigate apps even if the interface changes slightly, reducing the likelihood of detection by security software that looks for rigid, predictable command sequences.

Data theft and removal resistance

The malware is designed to steal sensitive data, including banking credentials, cryptocurrency details, and one-time passwords from SMS messages. It achieves this by displaying HTML overlays on top of targeted applications and intercepting notifications. It can also capture lock-screen PINs and unlock patterns.

RatHat actively works to prevent its own removal. When a user attempts to uninstall the app, the malware intercepts the confirmation screen and cancels the procedure. It then displays a fake Google Play overlay with a bogus error message to confuse the user. Additionally, the malware employs anti-analysis techniques, such as bloated manifest files and invalid instructions, to disrupt security analysis tools.