RatHat Android malware analysis with AI-assisted UI automation and anti-analysis layers
Technical Analysis
Summary
Hide ▲
Show ▼
RatHat is a new Android malware campaign analyzed by Zimperium zLabs and linked to China-based threat actors. It uses an AI-powered UI-automation subsystem to steer compromised devices in real time, serializing the live Accessibility tree and sending it to an AI assistant for navigation and on-screen text extraction. The malware abuses Accessibility permissions, enables Developer Options and Wireless Debugging for ADB shell access, and deploys agents for persistence and tunneling while targeting banking and cryptocurrency apps for credential theft, OTP interception, and lock-screen data capture. It also includes anti-analysis and anti-debug layers, plus removal-blocking behavior that can cancel uninstall attempts and fake a Google Play error.
Related Happenings
RatHat Android credential-theft malware
Malware Activity
H score27
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.
About this happening:
RatHat is a new Android malware activity linked by Zimperium to China-based threat actors and focused on stealing banking credentials, 2FA/OTP data, notifi...
RatHat Android credential-theft malware
Malware ActivityHow related: Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.
About this happening: RatHat is a new Android malware activity linked by Zimperium to China-based threat actors and focused on stealing banking credentials, 2FA/OTP data, notifi...
Latest development: 18.09.2026 09:17
Zimperium said RatHat pairs Accessibility abuse with autonomous local ADB (Android Debug Bridge) self-pairing to break out of the Android sandbox, unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code. The malware stages native daemons that execute with shell-level privileges, lets a Go Agent masquerading as liblocal-service.so apply persistence and power management exemptions, and can re-install itself through the local service after uninstall. The operator also uses an FRP reverse-proxy client to establish a persistent reverse tunnel to the C2 server, while the malware can record finger presses on screen with a hardware-level keylogger.
RatHat smishing-malvertising Android APK distribution campaign
Campaign
H score36
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening:
RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
RatHat smishing-malvertising Android APK distribution campaign
CampaignHow related: RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening: RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
Mantax Otax Android malware activity
Malware Activity
H score32
First: 11.09.2026 00:40
Last: 11.09.2026 00:40
Sources 1
About this happening:
The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Mantax Otax Android malware activity
Malware ActivityAbout this happening: The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware Activity
H score19
First: 10.09.2026 17:36
Last: 10.09.2026 17:36
Sources 1
About this happening:
The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware ActivityAbout this happening: The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
MantaxOtax Android malware with ransomware and spyware control
Malware Activity
H score32
First: 10.09.2026 16:00
Last: 10.09.2026 16:00
Sources 1
About this happening:
The MantaxOtax Android malware now combines file encryption with spyware-style surveillance, putting infected phones at risk of both lockout and data theft. It can ste...
MantaxOtax Android malware with ransomware and spyware control
Malware ActivityAbout this happening: The MantaxOtax Android malware now combines file encryption with spyware-style surveillance, putting infected phones at risk of both lockout and data theft. It can ste...
Timeline
-
17.09.2026 16:00 4 articles · 4d ago
Zimperium analyzes RatHat Android malware with AI-assisted UI automation
Technical Analysis UpdateZimperium’s zLabs identified RatHat, a new Android malware strain linked to China-based threat actors that steals banking credentials, notifications, 2FA/OTP data, and screen or input content. The sample uses a generative AI user interface-automation engine, serializes the target device’s live Accessibility tree to XML, and appears to use Google’s Gemini AI models for operator-controlled navigation and clicks while relying on four anti-analysis layers and one anti-debug layer, plus a dropper with two encrypted assets and SessionInstaller API abuse.
Show sources
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00
- New RatHat Android malware uses AI to automate device control — www.bleepingcomputer.com — 18.09.2026 00:50
- RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall — thehackernews.com — 18.09.2026 09:17