Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem
The malware pretends to be a legitimate download for an app like Google Chrome.
A new AI-powered malware called RatHat has emerged as a concerning threat to Android users. Discovered by mobile security firm Zimperium, RatHat masquerades as legitimate apps like Google Chrome, tricking users into downloading it through fake web pages that mimic the Google Play Store. Once installed, the malware exploits accessibility permissions granted by users to gain full control of the device.
It installs an AI-assisted agent that captures information and a proxy client to send stolen data back to hackers. RatHat primarily targets popular Chinese apps like WeChat Pay and Alipay, but other financial apps are also at risk. Unlike ransomware, RatHat remains dormant and stealthy, capturing sensitive data such as usernames, passwords, and two-factor authentication codes without immediate detection.
It can even steal raw touch input, enabling it to recreate PIN codes and pattern unlock codes. The only way to detect RatHat is through an antivirus scan. While some antivirus apps, including Malwarebytes, can detect the malware, complete eradication requires a factory reset, removing hidden secondary files that antivirus apps cannot handle.
Users are warned against clicking suspicious links from unknown sources, verifying the official Google Play app, and denying accessibility permissions. SMS phishing is highly targeted and varies by region, so standard antiphishing practices and denying accessibility permissions are crucial in thwarting this complex threat.
Written by urgent.news from CNET's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
