Android malware can steal your PIN and bank logins

Live updates

1. 1h ago

   RatHat Android Malware Uses AI to Steal Banking Credentials and PINs

   RatHat is a new Android banking trojan that employs generative AI to steal banking credentials, intercept two-factor authentication codes, and reconstruct PINs or pattern locks via touch input analysis. Discovered by Zimperium researchers, the malware requires users to install a malicious app and grant powerful permissions to function. Once active, RatHat can establish a persistent connection that may remain on the device even after the malicious application is removed. The malware's console specifically uses Gemini AI to help attackers identify and target higher-value victims.

   Why it matters

   The emergence of RatHat reflects a shift toward AI-integrated cybercrime. By combining Gemini AI with ADB shell access, attackers can automate the identification of lucrative targets and maintain deeper device control. This threat highlights the risk of social engineering where users are tricked into granting excessive permissions.

   What is confirmed

   • RatHat malware can steal banking credentials and intercept two-factor authentication codes.
   • The malware can reconstruct a user's PIN or pattern lock by analyzing touch inputs on the screen.
   • RatHat utilizes Gemini AI to identify higher-value victims.
   • The attack requires the user to install a malicious app and approve powerful permissions.
   • RatHat can create a persistent connection that may survive the removal of the malicious app.

   Still unconfirmed

   • Group-IB uncovered a banking trojan called RemControl built with AI help.

   What to watch next

   • Evidence of RatHat infections in the wild beyond research environments
   • Updates from Google regarding Android security patches to block RatHat's persistence methods
   • Confirmation of the relationship between RemControl and RatHat
   Sources used for this update (10)

   1. Fox News — Android malware can steal your PIN and bank logins
   2. cyberpress.org — RATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of Devices
   3. The Hacker News — RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
   4. Pasquale Pillitteri — Group-IB uncovers RemControl, the Android banking trojan built with AI help
   5. infosecurity-magazine.com — RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
   6. www.foxnews.com — RatHat Android malware uses AI to steal bank logins and ...
   7. www.foxnews.com — Windows malware uses Grok AI to help stay hidden, researchers say
   8. www.cyberghostvpn.com — Types of Identity Theft: 13 Common Red Flags and How to Protect Yourself - CyberGhost VPN
   9. thezonerocks.com — Android malware can steal your PIN and bank logins
   10. usvinews.com — Android malware can steal your PIN and bank logins - Fox News
   confidence 90%