Zimperium reports RatHat malware using AI to navigate Android devices

Zimperium zLabs reported a new Android malware family, RatHat, that uses an AI-powered subsystem to remotely navigate compromised devices. Researchers said it is distributed through malvertising, SMS, and phishing sites promoting APKs outside Google Play, and they linked it to Chinese-language operators after finding LLM prompts written in Chinese. The malware abuses Accessibility permissions, enables Developer Options and Wireless Debugging for local ADB-level execution, and installs a Go-based agent that persists even if the main payload is removed. It can overlay banking and cryptocurrency apps, intercept SMS and one-time passwords, and capture lock-screen credentials. Zimperium said RatHat serializes the Accessibility tree into XML and sends it to an unnamed popular AI assistant for navigation instructions, making control more adaptable than scripted automation.