Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem

Live updates

1. 33d ago

   RatHat Android Malware Uses AI to Steal Credentials

   The RatHat Android malware leverages artificial intelligence to infiltrate devices, steal banking credentials, and intercept two-factor authentication codes. Security investigations reveal that the malicious software disguises itself as trusted applications like Google Chrome to deceive users into installation. Once active, the trojan abuses Android Accessibility features and Gemini AI to reconstruct user PINs or pattern locks from touch inputs, estimate bank balances from text messages, and control infected phones. Operators manage these operations through an external web console while maintaining persistence via the Android Debug Bridge.

   Why it matters

   Banking trojans have historically relied on manual scripting and rigid automation to extract financial data from mobile operating systems. The integration of advanced artificial intelligence into RatHat represents a sophisticated shift in threat actor capabilities, moving beyond simple credential harvesting to dynamic device navigation and biometric reconstruction. Security analysts are monitoring how malicious frameworks exploit legitimate developer tools and accessibility settings to bypass modern operating system protections.

   What is confirmed

   • RatHat is an Android malware that uses artificial intelligence to steal banking app credentials.
   • The malware intercepts two-factor authentication codes.
   • RatHat abuses Gemini AI and Accessibility features to control infected phones.
   • The trojan reconstructs PINs or pattern locks from touch inputs.

   Still unconfirmed

   • Google has issued official guidance or specific protection steps regarding the RatHat malware threat.

   What to watch next

   • Official technical advisories or security updates from Google regarding Android Accessibility abuse
   • Discovery of additional distribution channels or fake applications used to spread RatHat
   • Telemetry data showing the total volume of infections or targeted banking institutions
   Sources used for this update (3)

   1. cybersecuritynews.com — RATHat Android Malware Uses Gemini AI to Control Phones ...
   2. www.foxnews.com — RatHat Android malware uses AI to steal bank logins and ...
   3. www.hexeba.com — Android Malware 'RatHat' Steals PINs, Bank Logins with AI ...
   confidence 100%
2. 37d ago

   RatHat Android Malware Uses Gemini AI to Target Wealthy Victims

   RatHat is an advanced Android banking trojan that uses artificial intelligence to steal credentials, intercept authentication codes, and navigate infected devices. Security researchers discovered that the malware disguises itself as a legitimate application, such as Google Chrome, to trick users into downloading it. Once installed, it leverages the Android Debug Bridge to maintain persistent access, meaning the malicious background daemon survives even if the user uninstalls the main app. Operators control the malware through a web console, utilizing Google's Gemini AI to estimate victim bank balances from intercepted text messages.

   Why it matters

   Security company Cleafy has traced nearly 100 deployments of the RatHat web console since April 2026, operating under a malware-as-a-service model. The use of generative artificial intelligence to guide device navigation and sort victims by estimated wealth marks a significant escalation in mobile cyberthreat capabilities. Because the malware sets up wireless debugging and self-pairs to ADB, standard removal methods fail.

   What is confirmed

   • RatHat disguises itself as a legitimate download for applications like Google Chrome to infiltrate Android devices.
   • The malware uses generative artificial intelligence to assist with device navigation, credential theft, and authentication-code interception.
   • RatHat enables wireless debugging, reads its own pairing code from the screen, and self-pairs to ADB so the background daemon survives app uninstallation.
   • Security company Cleafy traced nearly 100 deployments of the RatHat web console since April 2026.
   • The latest version of the RatHat console integrates Google's Gemini AI to estimate bank balances from text messages and sort victims into high-value and mid-value categories.

   What to watch next

   • Further security analysis detailing the scale of infections across specific geographic regions.
   • Additional discoveries regarding how operators scale the malware-as-a-service model.
   Sources used for this update (12)

   1. thehackernews.com — RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
   2. www.cnet.com — Say Hello to RatHat, a New AI-Powered Malware Invading the ...
   3. redbotsecurity.com — RatHat AI-Assisted Android Malware | Redbot Labs
   4. fmcybersecurity.com — RatHat: how AI helps malware navigate an Android phone
   5. www.deccanherald.com — RatHat malware: New Android cyber threat steals data, here's ...
   6. recatools.com — Uninstall RatHat and It Reinstalls Itself — Practical Tools ...
   7. dictionary.cambridge.org — SAY | English meaning - Cambridge Dictionary
   8. www.vocabulary.com — Say - Definition, Meaning & Synonyms | Vocabulary.com
   9. www.youtube.com — Say - YouTube
   10. dictionary.cambridge.org — SAY | definition in the Cambridge English Dictionary
   11. www.dictionary.com — SAY Definition & Meaning | Dictionary.com
   12. en.wiktionary.org — say - Wiktionary, the free dictionary
   confidence 95%
3. 45d ago

   RatHat AI Malware Targets Android Bank Credentials

   RatHat is a new AI-powered malware targeting Android devices to steal bank logins, PINs, and credentials. The software employs artificial intelligence to facilitate theft and utilizes Android Debug Bridge (ADB) to maintain shell access even after a user uninstalls the application. Because the malware persists after deletion, infected users are advised to perform a factory reset to fully clear the threat from their devices.

   Why it matters

   Mobile banking security relies on the integrity of the device operating system. Malware that survives uninstallation creates a permanent backdoor for attackers. This shift toward AI-driven theft increases the efficiency of credential harvesting on mobile platforms.

   What is confirmed

   • RatHat is AI-powered malware targeting the Android ecosystem.
   • The malware steals bank logins, PINs, and credentials.
   • RatHat remains on the device after deletion.

   Still unconfirmed

   • Infected devices require a factory reset to remove RatHat.
   • RatHat abuses ADB to retain shell access after uninstall.

   What to watch next

   • Identification of the specific AI models used by RatHat
   • Security patches from Google to block ADB abuse for persistence
   • Reports on the total number of infected devices
   Sources used for this update (6)

   1. CNET — Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem
   2. Zimperium — RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts
   3. Malwarebytes — New Android malware uses AI to steal bank logins and PINs
   4. The Hacker News — RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
   5. Inshorts — New Android malware uses AI to steal bank logins, remains after deletion | Do factory reset if device infected with RatHat | Inshorts
   6. www.cnet.com — AI ‘Actress’ Tilly Norwood Glitches on Live TV in Surreal Nightmare
   confidence 90%