New Android malware uses an AI layer to drive your phone and lift banking PINs

Zimperium zLabs has identified a new Android malware family called RatHat that pairs a remote-access trojan with an AI-powered subsystem, so automated software rather than a human operator can read a phone’s screen and decide where to tap next. The malware displays fake login overlays on top of real banking and cryptocurrency apps to capture account credentials, and it separately records the PIN, password or pattern a victim uses to unlock the device. Zimperium says the malware’s AI prompts are written in Chinese, which the researchers use to tie RatHat to threat actors they believe operate out of China.

The AI subsystem that reads RatHat’s target screen

Zimperium’s researchers found that RatHat serializes the live Android Accessibility tree, the same data structure Android’s built-in screen readers use to describe an interface, into XML and forwards it to a commercial AI assistant the company does not name in its report. The model returns three kinds of answers when queried: the pixel coordinates of a specific on-screen element, that element’s actual visible text, and a navigation command such as SCROLL_DOWN. That loop lets a remote operator issue RatHat a goal rather than a fixed script of coordinates, and the malware carries out the individual taps, scrolls and text entries required to reach it on its own, adjusting as the interface it is reading changes.

“RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation,” Zimperium zLabs said in the analysis it published on September 17. The researchers tie the malware to threat actors they believe operate out of China, a link based on finding the sample’s AI navigation prompts written in Chinese rather than on any other evidence disclosed.

That adaptability changes who has to be present when RatHat is actually used. Because the AI subsystem interprets the screen as it goes rather than following a fixed script, Zimperium says the design allows remote navigation without requiring RatHat’s operators to perform real-time interaction with the device themselves.

Banking overlays and a separate PIN-logging channel

Like most Android banking trojans, RatHat abuses Android’s Accessibility permissions to draw HTML overlays on top of targeted banking and cryptocurrency apps, tricking a victim into typing account credentials into a fake login screen the malware controls instead of the real one underneath it. The overlay channel runs independently of the AI navigation loop: it activates automatically whenever a victim opens one of the targeted financial apps, whether or not the AI subsystem happens to be steering the device at that same moment. Zimperium did not publish a list of the specific banking or cryptocurrency apps RatHat targets.

A second, separate function captures the device’s own lock screen rather than any single app. Zimperium found RatHat can intercept SMS messages and notifications, including one-time passcodes; log text as it is typed into any field; pull URLs out of the browser’s address bar; and record the PIN, password or pattern a victim enters to unlock the phone itself. Combined with the banking overlays described above, that gives a remote operator both the login credentials to a victim’s financial accounts and the unlock code for the device those accounts are reached through.

Distribution, persistence and anti-removal tricks

Zimperium says RatHat spreads through malvertising, SMS messages and phishing sites that push APK downloads from outside Google Play, then enables Developer Options and Wireless Debugging to gain shell-level access without a computer physically connected to the device. A Go-based agent installed through that access, which Zimperium names liblocal-service.so, runs commands with that access, creates battery-restriction bypasses so the malware keeps running in the background, and restores RatHat if the app is ever removed or stopped. The relationship runs both directions: a second component, libmedia_codec.so, opens a persistent reverse-proxy tunnel back to the attacker’s infrastructure, and the malware itself will reinstall the Go agent if that piece is deleted instead.

RatHat also resists deletion directly. Zimperium found it intercepts the standard Android uninstall confirmation screen, cancels the removal request, and displays a fake Google Play error message meant to convince the victim that nothing happened. The sample Zimperium analyzed also carried a bloated, 61-megabyte manifest file, tampering inside its APK container, and invalid DEX pseudo-instructions, all deliberately included to slow down or break the tools researchers and antivirus engines rely on to analyze suspicious APKs.

Google’s response and what Play Protect covers

Google addressed the findings directly. A Google spokesperson told BleepingComputer on September 21 that current detection shows no apps containing this malware on Google Play, and that Android users are automatically protected against known versions of the malware by Google Play Protect, which is on by default on Android devices with Google Play Services.

Zimperium’s advice mirrors Google’s response: avoid installing APK files from outside Google Play unless the publisher is explicitly trusted, decline Accessibility permission requests from apps with no obvious reason to need them, and keep Play Protect scanning turned on. Neither recommendation addresses the underlying design RatHat exploits. An AI model reading a serialized Accessibility tree has no built-in way to tell whether the screen it is describing belongs to the phone’s owner or to a remote attacker issuing commands through a compromised app, which is the gap Zimperium’s report leaves open for the industry to close.

More from Morning Overview

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.