RatHat malware harnesses AI to target banking data

Cybersecurity researchers have unveiled a new Android malware strain called RatHat, which employs generative artificial intelligence to enable attackers to infiltrate infected devices and pilfer banking credentials, payment data, and authentication codes. Disclosed by Zimperium’s zLabs team on September 16, the malware’s technical indicators suggest the threat actors might be operating from China.

While the researchers refrain from outright attribution, they base this assessment on Mandarin-language prompts found within the malware’s AI-driven automation system. RatHat amalgamates spyware, remote-access, and persistence capabilities into a multi-stage infection sequence. Primarily spread through SMS phishing, malicious advertising, and deceptive third-party download portals that entice victims into installing Android package files outside Google Play, the malware typically masquerades as applications such as streaming services, web browsers, and financial tools to make sideloading seem legitimate.

Upon installation, RatHat leverages Android Accessibility permissions and strives to enable Developer Options and Wireless Debugging, thereby establishing a local Android Debug Bridge (ADB) shell context without necessitating a physical connection between the phone and an external computer. This access grants operators permissions beyond the typical constraints associated with standard applications.

Following the installation, the malware deploys a Go-based native agent, labeled as liblocal-service.so, which can execute commands via ADB shell privileges. Known as libmedia_codec.so, this secondary native component operates as a reverse-proxy client, establishing a persistent tunnel between the compromised device and the attackers’ command-and-control infrastructure.

This tunnel facilitates separate remote access to the device’s ADB daemon and allows commands to be carried out autonomously, irrespective of the malware’s inherent functionalities. RatHat's financial-exploitation capabilities encompass fraudulent HTML overlays mimicking banking, payment, and cryptocurrency interfaces, enabling the capture of login credentials and payment information entered by the victim.

Moreover, the malware can intercept SMS messages and notifications, potentially exposing one-time passwords and two-factor authentication codes. Researchers discovered that RatHat can record text-change events, gather URLs from browser address bars, and capture lock-screen credentials, including PINs, passwords, and unlock patterns.

By combining screen observation, input collection, and privileged shell access, the malware equips operators with multiple avenues to obtain sensitive financial and personal data from a compromised phone. The malware's unique selling point is an AI-assisted user-interface automation engine. RatHat transforms the device's live Android Accessibility tree into XML and relays this data to a popular generative AI assistant, the specific provider of which Zimperium has not disclosed.

The AI system can ascertain the center coordinates of a requested on-screen element, discern the text displayed by interface components, and furnish navigation instructions such as scrolling commands. These responses can subsequently guide synthetic clicks and other actions, enabling the malware to adjust to interfaces whose layout or wording might vary between devices or applications.

Zimperium posits that this AI-enhanced decision loop reduces dependence on rigid, pre-programmed scripts. Typically, traditional mobile malware relies on fixed screen coordinates, hard-coded element identifiers, or manually operated remote sessions. However, RatHat's AI-assisted approach can interpret evolving interface structures and direct actions as the device state changes.

The researchers also documented obstacles designed to complicate the analysis or removal of RatHat. These include APK container manipulation, malformed or inflated application data, and invalid instructions intended to impede analysis tools. The malware can also intercept an uninstall confirmation screen, thwart the removal process, and display a deceptive Google Play error message to the user.

Its dropper embeds the main payload in encrypted assets and exploits Android installation mechanisms to circumvent restrictions surrounding protected settings and Accessibility access. Despite these sophisticated measures, the infection hinges on victims installing applications from untrusted sources and approving permissions that expose powerful device functions.