Security researchers at Zimperium zLabs have identified RatHat, a newly discovered Android malware variant that employs machine learning capabilities to facilitate remote device manipulation. Evidence suggests the threat originates from Chinese-speaking threat actors, based on LLM prompts discovered within the malware's code.
Distribution occurs through multiple channels including malvertising campaigns, SMS messages, and phishing pages directing users to download APK files outside the official Google Play store. The malware operates by abusing Android's Accessibility permissions to execute privileged operations on infected devices.
Persistence and shell-level access
RatHat's core functionality centers on enabling Developer Options and Wireless Debugging, granting it local shell-level execution without needing an external computer—a technique previously observed in ToxicPanda and RedHook malware families. This approach provides ADB access to the compromised device.
Two Go-based agents work in tandem to maintain control. The first agent, liblocal-service.so, executes commands with ADB shell privileges, disables battery restrictions, and establishes persistence mechanisms. Notably, this agent restores itself if removed, while the malware reciprocates by restoring the agent if the malware itself is deleted.
A second agent, libmedia_codec.so, functions as an FRP reverse-proxy client, maintaining a persistent tunnel back to the attacker's infrastructure.
Credential theft and interception capabilities
The malware deploys HTML overlays targeting banking and cryptocurrency applications to harvest login credentials. Beyond credential capture, RatHat intercepts SMS messages and push notifications, including one-time passwords; monitors text-input events; extracts URLs from browser history; and captures lock-screen PINs, passwords, and unlock patterns.
AI-powered interface automation
RatHat's distinguishing feature involves an AI-driven user interface automation engine that converts the live Android Accessibility tree into XML format and transmits it to a commercial AI assistant (not identified in the report). The AI system performs three core functions:
- Locating the center coordinates of named interface elements
- Extracting actual on-screen text from UI components
- Generating navigation commands such as 'SCROLL_DOWN' and similar actions
This AI-augmented approach renders RatHat's interface manipulation substantially more flexible than script-based automation, enabling attackers to navigate devices remotely without continuous operator involvement. According to Zimperium, "RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation."
Anti-removal and anti-analysis defenses
The malware actively resists removal by intercepting uninstall confirmation dialogs, canceling the uninstall process, and presenting users with a counterfeit Google Play overlay displaying a fabricated error message.
Multiple anti-analysis techniques protect the malware from reverse engineering, including APK container tampering, an oversized 61MB Android manifest file, and malformed DEX pseudo instructions designed to obstruct or disable analysis tools.
Mitigation recommendations
- Avoid downloading APK files from sources outside Google Play unless the publisher is explicitly trusted
- Refrain from granting Accessibility permissions to applications unless absolutely necessary
- Regularly scan devices using Play Protect or equivalent mobile security solutions