RatHat malware uses Android accessibility access to steal credentials

Zimperium researchers identified RatHat, Android malware that uses an AI assistant and accessibility permissions to navigate infected devices, capture messages and steal passwords and multifactor authentication codes. Attackers distribute it through fake websites that imitate the Google Play Store and offer applications disguised as legitimate software. After a user grants accessibility access, RatHat activates Android Wireless Debugging and pairs with the device. It can create credential-stealing overlays and record raw screen touches. The reported defense is to avoid untrusted downloads; an infected device requires a factory reset to remove the malware.