Zimperium reports RatHat malware using AI to navigate Android devices
Image: Primary Zimperium zLabs reported a new Android malware family, RatHat, that uses an AI-powered subsystem to remotely navigate compromised devices.
Researchers said it is distributed through malvertising, SMS, and phishing sites promoting APKs outside Google Play, and they linked it to Chinese-language operators after finding LLM prompts written in Chinese. The malware abuses Accessibility permissions, enables Developer Options and Wireless Debugging for local ADB-level execution, and installs a Go-based agent that persists even if the main payload is removed.
It can overlay banking and cryptocurrency apps, intercept SMS and one-time passwords, and capture lock-screen credentials. Zimperium said RatHat serializes the Accessibility tree into XML and sends it to an unnamed popular AI assistant for navigation instructions, making control more adaptable than scripted automation.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
