RatHat: AI-Driven Android Malware Abuses Wireless Debugging to Steal Banking Credentials

Executive Summary

On September 16, 2026, Zimperium's zLabs research team published analysis of RatHat, a newly identified Android malware family that pairs conventional banking-trojan capabilities — credential-harvesting overlays, SMS/OTP interception, PIN and pattern theft — with a generative AI subsystem used to navigate a compromised device's interface in real time.¹² RatHat serializes the phone's live Android Accessibility tree into XML and sends it to what Zimperium's report describes only as "one of the world's most popular generative AI assistants," communicating with it in Mandarin to resolve on-screen element coordinates, read on-screen text, and issue navigation commands such as SCROLL_DOWN.³

Distribution is via smishing, malvertising, and phishing sites promoting APK downloads outside Google Play, using the same Accessibility-permission social-engineering pattern seen in prior families such as ToxicPanda and RedHook.¹ Once installed, RatHat's dropper uses native Android SessionInstaller APIs to bypass restricted settings and Accessibility Service protections, then automates enabling Developer Options and Wireless Debugging to pair with the device's local ADB service — gaining shell-level command execution without needing an attacker-controlled computer physically connected to the device.²³ Two disguised native components are then installed: a Go-based local agent (liblocal-service.so) that executes ADB-shell commands, exempts the app from battery restrictions, and disables competing security apps, and a Fast Reverse Proxy client (libmedia_codec.so) that opens a persistent tunnel back to the attacker's infrastructure.³⁴

RatHat's standout persistence mechanism is designed to survive user-initiated removal: it can intercept and fake the Android uninstall-confirmation screen, but even a successful removal does not fully evict it, because the Go agent runs independently of the visible app's lifecycle, periodically checks whether the package is still present, and silently reinstalls it from a local cache if it is gone.¹⁴ Zimperium attributes the malware to operators likely based in China, an assessment built primarily on the presence of Mandarin-language prompts sent to the embedded AI assistant, rather than on infrastructure or identity evidence.¹³

Verification of Claims

1. Claim: RatHat uses a generative AI assistant to navigate the device's Accessibility tree in real time rather than relying solely on fixed, scripted automation. → Verified — described directly in Zimperium's own analysis, independently reported by three outlets that reviewed the report.¹²³

2. Claim: RatHat's persistence mechanism can survive a user successfully uninstalling the visible app. → Verified — confirmed by Zimperium and corroborated in the IOC/architecture detail published by Cyber Security News from the shared Zimperium report.¹⁴

3. Claim: The malware's operators are based in China. → Partially verified — this is Zimperium's assessment, based on the AI prompts being written in Mandarin; it is not corroborated by infrastructure, registration, or identity evidence in any of the public reporting reviewed.¹³

4. Claim: RatHat's AI assistant is Google's Gemini. → Unverified — Zimperium's report explicitly does not name the AI service used; one outlet reports that an architecture diagram in the vendor report "suggests" Gemini, but this is an inference from a diagram, not a stated conclusion by the researchers.³

Timeline

Attack Anatomy

Delivery and initial access

Victims are directed to phishing pages via SMS phishing (smishing), malvertising, and third-party forums, and are persuaded to manually install an APK disguised as a legitimate app.¹⁴ The dropper carries the payload as two encrypted assets and uses native SessionInstaller APIs to bypass Android's restricted-settings protections, gaining the ability to enable Accessibility Service access with reduced friction compared to a standard permission prompt.³

Privilege escalation

With Accessibility access established, RatHat uses automated synthetic taps to enable Developer Options and Wireless Debugging in the device settings, then reads the pairing code and port Android displays and pairs with the phone's own local ADB service.¹⁴ This grants shell-level command execution without an attacker needing a physically or network-connected computer — a technique previously documented in the ToxicPanda and RedHook Android malware families.¹

Installation and persistence

Two disguised native libraries are dropped into a system directory: liblocal-service.so, a Go-based agent that executes commands via the local ADB shell, disables battery restrictions, deprioritizes competing security apps, and manages persistence; and libmedia_codec.so, a Fast Reverse Proxy (FRP) client that opens a durable tunnel to the attacker's C2 infrastructure independent of the visible app.³⁴ If the user uninstalls the visible app, the Go agent — which runs outside the app's normal lifecycle — detects the missing package and silently reinstalls it, while a fake uninstall-failure overlay attempts to stop the removal attempt in the first place.¹⁴

Data theft and AI-guided control

RatHat displays HTML overlays mimicking targeted banking, cryptocurrency, and payment apps to capture login credentials, and separately monitors raw touchscreen input to infer PINs, passwords, and unlock patterns — a technique intended to defeat defenses built around blocking screenshots or Accessibility-based text capture.¹³ It intercepts SMS messages and notifications (including one-time passcodes), records text-change events, and extracts URLs from the browser address bar.¹ For navigation, the malware serializes the live Accessibility tree to XML and queries a generative AI assistant — in Mandarin — for element coordinates, on-screen text, and scroll/navigation instructions, letting operators direct the device without manual, real-time interaction.¹³

Threat Actor Profile

Name: Unattributed; tracked only through the malware family name RatHat Assessed origin: Operators likely based in China Attribution confidence: Low-to-moderate — Zimperium's own basis is the AI assistant being queried in Mandarin-language prompts found during analysis, which is suggestive of the operators' working language but is not accompanied by infrastructure, registration, or identity evidence in the reporting reviewed.¹³

RatHat is a newly identified family with no confirmed lineage to a previously tracked group. Zimperium draws technique-level comparisons — not attribution — to two other recently documented Android malware families: ToxicPanda, which shares the pattern of abusing Accessibility permissions for device takeover, and RedHook, which shares the specific technique of abusing Wireless Debugging/ADB pairing for shell-level access.¹ The malware's sophistication — a three-component architecture (dropper app, Go-based privileged agent, FRP reverse-proxy client), four anti-analysis layers plus an anti-debug layer, and a genAI-driven UI automation engine — indicates a well-resourced development effort rather than an opportunistic or commodity build.³

MITRE ATT&CK techniques (Mobile matrix):

Technical Indicators

native_libraries:
  - liblocal-service.so   # Go-based local agent: ADB-shell execution, persistence, permission changes
  - libmedia_codec.so     # Fast Reverse Proxy (FRP) client: persistent C2 tunnel
files_and_paths:
  - /data/local/tmp/app.apk        # cached APK used to silently reinstall RatHat
  - local-service.update           # staged local-agent update file in /data/local/tmp/
  - server_config.json             # alters malware launcher appearance
  - svc_config.html                # local HTML lure to persuade Accessibility grant
  - locateValues.json              # device-specific keypad/pattern-lock layout data
  - cert.pem                       # stolen device ADB certificate
  - private.key                    # stolen device ADB private key
local_service:
  - 127.0.0.1:7910   # local HTTP server started by the Go agent
note: >
  Source reporting explicitly defangs network indicators and advises re-fanging
  only inside controlled threat-intelligence tooling (MISP, VirusTotal, SIEM).
  No attacker-infrastructure domains or IPs were published in the reporting
  reviewed for this paper as of publication.

Legal and Regulatory Response

No law enforcement action, platform takedown, or regulatory advisory tied specifically to RatHat had been published as of this paper's research cutoff (September 18, 2026). Zimperium states its Mobile Threat Defense (MTD) product detects RatHat's malicious payloads, phishing infrastructure, Accessibility exploitation, privilege escalation, and C2 activity, and that its Mobile Runtime Protection (zDefend) product is positioned to help banks and app owners detect overlays, screen-capture attempts, and debugging services associated with the malware.²

Impact Assessment

• Confirmed: The technical capabilities described (Accessibility abuse, ADB pairing via Wireless Debugging, overlay-based credential theft, SMS/OTP interception, AI-guided navigation, self-reinstalling persistence) are documented directly in Zimperium's analysis and corroborated across three independent outlets that reviewed the same report.¹³⁴
• Unknown: Victim count, geographic distribution of infections, and any confirmed financial losses. None of the reporting reviewed — including the vendor's own — discloses a scale figure, campaign duration, or named victim organizations.

Lessons and Defensive Recommendations

For end users:

• Install apps only from Google Play or another trusted first-party store; treat any APK offered through an SMS link, ad, or third-party forum as hostile by default.
• Refuse Accessibility Service requests from apps with no legitimate accessibility purpose, and treat an unexpected prompt to enable Developer Options or Wireless Debugging as a compromise indicator, not a routine setting.

For SOC/mobile threat defense teams:

• Alert on local ADB pairing events initiated without a connected debugging host, and on processes reading 127.0.0.1:7910 or similar loopback ports opened by non-system apps.
• Treat "successful uninstall, but the app or its permissions reappear" as an active-compromise signal requiring a full device wipe rather than a repeat uninstall attempt, given RatHat's out-of-lifecycle reinstallation mechanism.

For banks and payment providers:

• Require step-up verification for high-risk transactions originating from sessions showing signs of screen overlays, Accessibility-service activity, or active USB/wireless debugging, rather than relying on OTP delivery alone — RatHat is specifically designed to intercept SMS-delivered codes.¹

For platform/security vendors:

• The use of a general-purpose, publicly available generative AI assistant as a navigation co-processor — rather than a bespoke, hardcoded automation script — is a meaningful evasion shift: it adapts to unfamiliar UI layouts and languages, and detection strategies built around recognizing fixed tap-coordinate sequences will not generalize to this technique.¹³

Sources