Overview
- Security firm zLabs published a technical analysis that was reported by multiple outlets, which researchers released Monday, describing RatHat’s AI-driven automation and low-level input capture.
- RatHat sends the phone’s live Accessibility tree to a generative AI assistant so the malware can read on-screen content and decide taps and swipes in real time rather than following fixed scripts.
- The trojan creates fake WebView overlays, intercepts SMS and notifications, and logs raw touch coordinates to reconstruct PINs and unlock patterns so it can harvest logins and one-time codes.
- After getting Accessibility permission the malware enables Wireless Debugging or ADB pairing, drops a Go-based agent that runs with shell privileges, and uses an frp-derived reverse-proxy to give attackers a persistent remote tunnel.
- Researchers say RatHat spreads by smishing, malvertising and fake download pages that coax users into sideloading APKs, and they warn that infected phones may need a factory reset to fully remove the persistent shell agent and restore security.