RatHat Android Trojan Uses AI for Automation
A new Android trojan, dubbed RatHat, utilizes generative AI to automate device control and bypass security measures, according to Zimperium. Distributed through smishing and malvertising, the malware employs a multi-stage infection pipeline, including a dropper, a Go agent, and a reverse proxy client, to steal user credentials, intercept SMS messages, and maintain persistent access even after attempts to uninstall it. The AI component reconstructs PIN codes and passwords by analyzing screen content and user input, while the Go agent establishes a C&C connection and maintains administrator privileges.
A newly discovered Android trojan, RatHat, leverages generative AI to enhance its capabilities and evade detection, Zimperium reported. The malware is distributed through smishing campaigns and malvertising, utilizing an automated multi-stage infection pipeline to break out of Android’s application sandbox and establish shell-level execution.
RatHat contains typical mobile malware features, including credential theft, mimicking banking and payment applications to steal credentials and access codes, and establishing a covert communication channel with a command-and-control (C&C) server. Unlike other mobile threats, RatHat utilizes generative AI to navigate and control the device’s interface in real time, and monitors users’ input at the hardware level to reconstruct PIN codes, passwords, and patterns.
The malware is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions. Its architecture consists of three parts: a malicious Android application, a Go agent, and a reverse-proxy client, frpc, that establishes a secure, persistent reverse tunnel, giving attackers access to the ADB daemon for command execution. The Android application gains critical system permissions, bootstraps the infection chain, and provides an interface with the user.
RatHat can intercept and cancel uninstallation attempts. Even if the user removes the malware, its shell service remains on the device, periodically checks whether the application is still available, and reinstalls it if not. The malware implements keylogging through three specialized mechanisms: it monitors accessibility text-change events to reconstruct what the user typed, reads browser address bars by resource ID, and the Go agent can record, at the hardware level, where the user’s finger touched the screen. The Go agent abuses its execution in a shell environment to use the standard Android debugging tool getevent to read the raw device file the kernel writes to, extracting raw event coordinates and comparing them against the keypad layout.
Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
Related: New BTMOB Android Malware Enables Full Device Takeover
Related: Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
Related: North Korean Hackers Deploy New Linux Espionage Toolkit