Security researchers have uncovered an Android malware strain that employs generative AI to automate credential theft and bank detail harvesting. The malware, dubbed RatHat, was identified by Zimperium's zLabs team in a malware analysis published on September 16. The threat actors behind the campaign appear to be based in China, and they've built a sophisticated tool that leverages AI-driven interface automation to bypass Android's security protections.
RatHat spreads primarily through deceptive phishing websites promoted via malvertising, SMS phishing attacks, and third-party forums. Victims are tricked into manually downloading malicious Android package files that masquerade as legitimate applications. Once installed, the malicious app deploys RatHat through a dropper that carries the payload in two encrypted assets. The dropper takes advantage of native SessionInstaller APIs to circumvent Android's restricted settings and Accessibility Service safeguards, allowing installation of the malicious payload and subsequent access to protected APIs. The malware incorporates four anti-analysis layers and one anti-debug layer to evade Android's security controls.
The malware's architecture consists of three core operational components: a malicious Android application, a Go agent, and an FRP client. The app serves as the primary interface with the user, acquires critical system permissions, and initiates the rest of the infection sequence. It carries spyware capabilities designed to collect banking credentials, notifications, two-factor authentication and one-time-password keys, and capture screen content and inputs. The Go agent functions as the privileged command-and-control executor, running commands through the local ADB shell context to bypass app-level security restrictions. It handles critical system-level tasks like exempting the app from battery optimization and Doze mode, prioritizing its background execution, and disabling or uninstalling other packages such as security apps. The FRP client establishes a persistent, secure reverse tunnel from the infected device back to the attacker's command-and-control server, giving attackers ongoing remote access to the device's ADB daemon.
The zLabs team noted a particularly notable feature in the malicious app: a generative AI user interface-automation engine. RatHat serializes the target device's live Accessibility tree to XML and communicates in Mandarin with "one of the world's most popular generative AI assistants." This AI tool handles non-malicious actions including resolving a named target's center coordinates on the screen as JSON to direct synthetic clicks, resolving a target's actual on-screen text from the XML without translating, and signaling automatic navigation commands like SCROLL_DOWN. While the researchers didn't specify which AI tool is used, a graph in the report suggests the threat actors used Google's Gemini AI models. The prompts used by RatHat operators in the investigation are the main indicator pointing to potential China-based threat actors.
The report warns that RatHat's multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time generative AI decision loops illustrate why traditional, signature-based mobile security controls are insufficient. The malware's ability to exploit native Android APIs and combine multiple evasion techniques makes it particularly difficult for conventional security tools to detect and block. The use of generative AI for operational control represents a concerning evolution in mobile malware capabilities, allowing threat actors to automate complex user interface interactions that previously would have required manual intervention or hardcoded scripts. Organizations relying on mobile devices for banking and authentication should consider layered security approaches that go beyond signature detection, including behavioral analysis and runtime protection. For enterprise environments, the threat is especially acute given RatHat's capacity to harvest two-factor authentication credentials and one-time passwords that many organizations depend on for secure access. The integration of AI tooling into malware frameworks will likely accelerate as these models become more accessible and capable, demanding a fundamental rethinking of how mobile endpoints are secured and monitored.