# RatHat malware console uses Gemini to rank banking targets

_Published Monday, September 28, 2026 at 3:07 PM EDT · Security, AI · Latest · Tier 2 — Notable_

![RatHat malware console uses Gemini to rank banking targets — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvGUhf2JsmovUtvjDk66AKULOtbtRwTqgcT_6lr5l8AEuwc-12IQTTWfvjKCYEn6-wwc4ZLDWAWh6Edv3-XcPDL1HHPFwRkwY1Nc_BUItyEO8iCXBDKEitrgYapLi__gpKnYqtFNm1M2c4tGiY3qrS_CgRG5ZF5qnqVUv4Gx9Pqk_cPz4N05KVwUNgTcw/s1700-nu-rw-lo-l85-e365/gemini-malware.jpg)

Security company Cleafy found that the latest console for RatHat Android banking malware uses Google's Gemini model to estimate victims' bank balances from collected messages and sort infected phones by potential value. The console also lets operators build and distribute disguised apps and deploy a separate program that can control a phone through Android's debugging tools.

Cleafy traced nearly 100 console deployments since April 2026, a count of operator systems rather than infected phones. Its analyzed samples did not use Gemini to move money. Screen control without a permission prompt or recording icon relies on tools that do not work on Android 14 and later.

## Sources

- [The Hacker News](https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html)

---
Canonical: https://techandbusiness.org/newswire/d0Fs5dYlxHbRwOCfF8Gviz
Published: 2026-09-28T19:07:48.000Z
Story chronology: 2026-09-28T17:38:33.000Z
Retrieved: 2026-09-28T20:47:03.272Z
Publisher: Tech & Business (techandbusiness.org)