RatHat malware console uses Gemini to rank banking targets

Security company Cleafy found that the latest console for RatHat Android banking malware uses Google's Gemini model to estimate victims' bank balances from collected messages and sort infected phones by potential value. The console also lets operators build and distribute disguised apps and deploy a separate program that can control a phone through Android's debugging tools. Cleafy traced nearly 100 console deployments since April 2026, a count of operator systems rather than infected phones. Its analyzed samples did not use Gemini to move money. Screen control without a permission prompt or recording icon relies on tools that do not work on Android 14 and later.