A newly identified strain of Android malware, known as RatHat, has emerged as a sophisticated threat, leveraging generative AI to manipulate and control infected devices in real time. This alarming discovery was made by mobile security firm Zimperium, which shared its findings with Hackread.com. The research indicates that RatHat is linked to threat actors believed to be operating out of China.
What sets RatHat apart from traditional mobile threats is its innovative approach. Instead of relying on fixed scripts, it serializes the device’s live Accessibility tree into XML format, transmitting this data to a generative AI assistant. This AI can return screen coordinates, identify text displayed on the screen, and issue navigation commands such as scrolling.
Zimperium has reported that RatHat employs WebView-based HTML overlays that appear over targeted banking and cryptocurrency applications. These deceptive interfaces are designed to capture users’ login credentials. Additionally, the malware can infiltrate payment applications like WeChat and Alipay, using misleading overlays to extract PINs. It also features an SMS receiver and notification listener capable of intercepting one-time passwords (OTP) and two-factor authentication (2FA) codes.
Multi-Layer Stealth and System Access
RatHat is primarily disseminated through smishing and malvertising campaigns, as well as third-party forums that mislead victims into downloading malicious APKs. Once installed, the malware employs a series of anti-analysis layers to evade detection:
- Container Tampering: Alters ZIP structures to hinder analysis tools.
- Manifest Bombing: Utilizes an oversized AndroidManifest.xml file containing undocumented segments that can confuse static analysis tools.
- DEX Bytecode Poisoning: Incorporates malformed metadata to disrupt disassembly processes.
- String Encryption: Applies StringFog and a custom StringCrypto scheme to obscure strings.
- Anti-Debugging: Checks for debuggers, Frida, Xposed, root indicators, and emulators.
Upon gaining Accessibility access, RatHat activates Developer Options and enables Wireless Debugging. It retrieves the ADB pairing code and dynamic port displayed on the device, utilizing an embedded ADB library to connect to the phone’s local ADB service. This connection allows it to launch two Go binaries: a local control agent and an FRP reverse-proxy client. The control agent operates with shell-level privileges, granting access beyond that of a typical sandboxed Android application.
The FRP client establishes a persistent reverse tunnel to the attacker’s server, facilitating remote access to the device’s ADB service independently of the malware’s other functionalities.
PIN Theft and Persistent Reinfection
The Go agent employs Android’s getevent utility to capture raw touch coordinates from /dev/input/. RatHat then matches these coordinates against specific keypad and pattern layouts to reconstruct PINs and unlock patterns. This technique enables RatHat to bypass screenshot protections, such as FLAG_SECURE, by deducing credentials from raw touch events instead of relying on captured screen content.
Moreover, RatHat incorporates persistence mechanisms to resist removal. When a user attempts to uninstall the app, it presents a fake Google Play failure overlay. If the app is removed, the independent local service detects its absence and reinstalls the APK, while also restoring runtime permissions and Accessibility settings through shell commands.
This development follows Zimperium’s earlier identification of PixRevolution, an Android banking Trojan reported by Hackread.com in March. While PixRevolution targeted Brazil’s PIX payment system using real-time screen streaming and an agent-controlled approach to hijack transactions, RatHat distinguishes itself by employing generative AI to automate aspects of device interaction, moving beyond reliance on a remote operator.
