malware
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Medium
Summary
Cleafy researchers have uncovered a sophisticated Android banking trojan, RatHat, controlled through a web console. The malware collects data from infected phones and uses Gemini to determine which victims are worth targeting. The console has been used by nearly 100 operators since April 2026, with a significant portion of activity originating from a Singapore-based network.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data