Particle.news
Get it on Google Play
Download on the App Store
3 ARTICLES
·
3w ago

RatHat Trojan Uses Generative AI to Take Over Android Phones

Researchers say the malware reads a device’s live Accessibility tree, logs raw touch inputs and establishes an ADB reverse tunnel that can survive app removal, often requiring a factory reset to remove.

New malware called RatHat is targeting Android devices.

Overview

  • Zimperium’s zLabs disclosed Monday that it discovered RatHat, a multi-stage Android trojan that passes a serialized Accessibility tree to a generative AI to decide how to interact with on-screen apps.
  • The AI component interprets live UI structure so the malware can adapt taps and scrolls instead of following brittle scripts, making automated fraud harder for defenses to spot.
  • A native Go agent uses Android’s getevent tool to record raw touch coordinates and together with Accessibility text events and overlays can reconstruct PINs, capture passwords and intercept MFA codes.
  • RatHat escalates privileges by enabling Wireless Debugging and pairing to ADB, drops a shell-based Go agent and an frpc-derived reverse-proxy to keep remote shell access even after the visible app is removed.
  • Operators spread the trojan via smishing, malvertising and fake Play Store pages, researchers warn users to avoid sideloads and not grant Accessibility or developer/Wireless Debugging permissions, and say attribution to China is tentative and not definitive.