Security researchers at Zimperium have unveiled a sophisticated new strain of Android malware, aptly named RatHat, which is designed to harvest sensitive credentials and banking details. This malware is believed to be linked to threat actors operating from China and employs innovative techniques for persistence, utilizing generative AI to enhance its operational control.
RatHat’s Delivery: Smishing, Malvertising and Malicious App
RatHat primarily infiltrates devices through a combination of deceptive phishing sites, malvertising, and SMS phishing campaigns, commonly referred to as smishing. The malicious actors behind this campaign cleverly entice victims into downloading Android package kits (APKs) that masquerade as legitimate applications.
Upon installation, the malicious app activates RatHat through a dropper, which contains the payload hidden within two encrypted assets. This dropper takes advantage of native SessionInstaller APIs to circumvent Android’s restricted settings and Accessibility Service protections, facilitating the installation of the malicious payload and granting access to protected APIs. Additionally, RatHat is fortified with four anti-analysis layers and one anti-debug layer, enabling it to evade Android’s security measures.
RatHat’s Architecture Explained
The architecture of RatHat can be dissected into three core operational components:
- Malicious Android application
- Go agent (liblocal-service.so)
- FRP client (libmedia_codec.so)
The primary function of the app is to serve as the user interface, acquire essential system permissions, and initiate the infection chain. It possesses spyware capabilities, allowing it to collect banking credentials, notifications, two-factor authentication (2FA) codes, one-time-password (OTP) keys, and even capture screen inputs.
In a malware analysis released on September 16, Zimperium’s zLabs team highlighted a particularly intriguing feature of the malicious app: a generative AI user interface-automation engine. This engine serializes the target device’s live Accessibility tree into XML and communicates in Mandarin with a widely recognized generative AI assistant.
The AI tool is utilized for various non-malicious actions, including:
- Determining a named target’s center coordinates on the screen as JSON to facilitate synthetic clicks
- Extracting actual on-screen text from the XML without translation
- Issuing automatic navigation commands such as SCROLL_DOWN
While the specific AI tool employed remains undisclosed, researchers indicated that the prompts used by RatHat operators suggest a connection to Google’s Gemini AI models. The Go agent functions as the privileged command-and-control (C2) executor, executing commands through the local ADB shell context to bypass app-level security restrictions. It performs critical system-level tasks, including exempting the app from battery optimization/Doze mode, prioritizing background execution, and disabling or uninstalling other applications, particularly security apps.
Moreover, the FRP client establishes a persistent, secure reverse tunnel from the compromised device back to the attacker’s C2 server. This component is crucial for maintaining ongoing remote access to the device’s ADB daemon, effectively serving as a general-purpose backdoor capable of executing arbitrary commands independent of the malware’s built-in functionalities.
“RatHat’s multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient,” the zLabs report concluded, emphasizing the need for enhanced security measures in the face of such evolving threats.
