AI-Assisted Android Malware RatHat Automates Remote Device Hijacking
Researchers at Zimperium have identified a new Android trojan named RatHat that leverages an AI assistant to guide attackers through compromised devices. The malware abuses Accessibility permissions and enables wireless debugging to gain shell-level access, then installs agents for persistence and remote tunneling. It also overlays fake login screens on banking and crypto apps, intercepts SMS and notifications, and captures PINs and passwords.
RatHat spreads through malvertising, SMS lures, and phishing sites pushing sideloaded APKs. It exploits Accessibility privileges to enable Developer Options and Wireless Debugging, granting shell-level reach. A Go-based agent maintains persistence and restores the malware if removed, while a separate component establishes a reverse tunnel to attacker infrastructure.
The AI engine serializes the Accessibility tree into XML and queries a commercial assistant for element coordinates, on-screen text, and scroll commands, letting operators steer devices without live interaction. Anti-analysis measures include an oversized manifest, tampered APK container, and invalid DEX instructions meant to break analysis tools.
RatHat's AI-assisted approach could lower the skill barrier for device hijacking, potentially expanding the pool of attackers able to drain bank accounts and steal credentials. Android users who sideload apps face heightened risk, and the malware's persistence and removal-thwarting behavior may leave victims locked out of their own devices. Financial losses and privacy erosion could follow, while the AI component may complicate detection for both users and security vendors.