Zimperium's zLabs research team has published an analysis of a new Android malware family it calls RatHat, whose distinguishing feature is an AI-powered subsystem that helps operators remotely navigate compromised devices — serializing the live accessibility tree, sending it to a commercial AI assistant, and receiving navigation instructions in return.
The research, corroborated in independent coverage by BleepingComputer and The Daily Hodl, describes credential-theft overlays aimed explicitly at banking and cryptocurrency applications, alongside OTP interception, keylogging and lock-screen PIN capture.
Distribution and Privilege Chain
RatHat is distributed through malvertising, SMS and phishing sites promoting APK downloads from outside Google Play — the sideloading vector that remains Android's most reliable malware on-ramp.
Once installed, it abuses Android's Accessibility permissions — the same highly privileged surface exploited by most modern Android malware families — to perform a step that researchers flag as notable: it enables Developer Options and Wireless Debugging to obtain a local shell-level execution context without requiring an external computer, using mechanisms similar to those previously seen in the ToxicPanda and RedHook families.
That ADB-level access allows RatHat to install a Go-based agent (liblocal-service.so) that runs commands with shell privileges, creates battery-restriction bypasses, and manages persistence. The agent also restores the malware if it is removed or stopped — and the protection runs both ways, with the malware resurrecting the agent in turn. A second component (libmedia_codec.so) operates as an FRP reverse-proxy client, establishing a persistent tunnel back to the attacker.
What It Steals
According to the analysis, RatHat monitors the foreground application and, on detecting a targeted banking or crypto package, triggers an HTML overlay injection designed to capture account credentials. Beyond the overlays, it can intercept SMS messages and notifications — including one-time passwords — record text-change events as a keylogger, extract URLs from browser address bars, and capture lock-screen PINs, passwords and unlock patterns.
The AI Engine
The research's central finding is the adaptability of the interface automation. Instead of fixed scripts, RatHat serializes the live Android Accessibility tree into XML and sends it to a widely used AI assistant — not named in the report — tasked with identifying the coordinates of interface elements, determining on-screen text, and returning navigation instructions such as SCROLL_DOWN.
The result, Zimperium notes, is remote device operation that adapts to unfamiliar screens without an operator watching in real time, and that is harder for security software to detect than traditional scripted automation. The prompts embedded in the malware are written in Chinese; on that basis, researchers say they believe the threat actors behind it operate from China. That attribution is an inference from artifacts, not a confirmed identification.
Anti-Removal and Anti-Analysis
Users who try to uninstall RatHat are actively fought: the malware intercepts the uninstall confirmation screen, cancels the procedure, and displays a fake Google Play overlay carrying a bogus error message. Analysis is similarly obstructed — APK container tampering, a bloated 61MB Android manifest file, and invalid DEX pseudo-instructions all appear designed to break analysis tools.
The defensive guidance is standard but worth repeating: do not install APKs from outside Google Play unless the publisher is explicitly trusted, never grant Accessibility permissions to unrequested apps, and run regular Play Protect scans.
RatHat arrives the same week as the FomoPeek disclosure on iOS — two different platforms, two different distribution channels, one shared lesson: the freshest malware now targets the device layer beneath the wallet, not the wallet app itself.
TrustGrade covers the security and trust ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.