A new Android malware called RatHat is making the rounds. It's linked to China-based threat actors. And it uses AI to navigate and control infected devices.

Zimperium found it. The researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega published their analysis recently. The malware spreads through smishing (SMS phishing) and malvertising. It leads victims to fake download portals. Then it drops a malicious APK.

But the real story is what happens after installation. RatHat doesn't just steal data. It breaks out of the Android sandbox and stays on the device even if you uninstall it.

Let me break down how it works.

Quick Summary

How It Gets In

RatHat spreads through deceptive phishing sites. The attackers promote them via malvertising and smishing campaigns. They also use third-party forums.

The goal is to trick users into installing malware-laced APKs. These APKs act as a dropper. They launch the main payload. And they include layers of anti-analysis and anti-debug checks to avoid detection.

The four anti-analysis techniques:

• Container tampering: Declares certain files as directories or sets the ZIP encryption flag so Android's library ignores them, but other tools don't.
• Explosive manifest: Embeds unknown chunk headers in the AndroidManifest.xml file for making analysis pipelines fail.
• DEX bytecode pollution: Implements pseudo-instructions with invalid  attributes for failing disassembly.
• Dual string-encryption: Uses a scheme called StringCrypto: Base64 to resist analysis.

The Architecture

RatHat has three main components:

1. The Android app : gets permissions and launches the attack.
2. The Go agent : runs as a native library (liblocal-service.so) and executes commands.
3. The FRP reverse-proxy client : creates a tunnel to the C2 server.

The Android app starts by getting Accessibility permissions. Then it abuses them to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code.

That's the key. Once it has ADB access, it breaks out of the sandbox.

What It Does Once Inside

After breaking out, RatHat can:

• Serve overlays on specific apps to steal credentials.
• Screen recording through Android's MediaProjection API.
• SMS interception.
• Installation failure by overlaying a fake installation failure window like Google Play.
• Keystroke logging, especially of URL addresses typed on browser bars.
• Collect files, lock screen PINs, patterns, passwords, and a list of installed apps.

The Go agent also includes a hardware-level keylogger. It records finger presses on the screen.

And here's the scary part. Even if you uninstall the malware, the attacker still has shell access. The local service can check if RatHat is installed. If it's not, it reinstalls it.

The AI Connection

This is what makes RatHat different. It uses a popular generative AI assistant to navigate the device.

The malware serializes the live Accessibility tree to XML. Then it talks to the AI. The AI helps with things like:

• Resolving the center coordinates of a named target on the screen. That lets the malware direct synthetic clicks.
• Resolving the actual on-screen text from the XML.
• Signaling automatic navigation commands like SCROLL_DOWN.

So it's not just automated. It's AI-driven. That makes it harder to detect because the behavior looks more human.

The FRP Tunnel

The Go agent retrieves the FRP tunnel configuration from the C2 server. Then the FRP client establishes a persistent reverse tunnel.

That tunnel gives the attacker access to the ADB daemon. Zimperium calls it "a general-purpose road into the device." It carries whatever the operator wants. It's independent of the malware's own feature set.

The C2 server sends commands. The malware executes them. Simple.

Why This Matters

Zimperium's conclusion is blunt. RatHat's multi-tiered architecture, its use of out-of-lifecycle daemons, and its real-time GenAI decision loops show why signature-based mobile security isn't enough.

In other words, antivirus apps that look for known malware signatures will miss this. You need behavioral detection. You need to watch for unusual ADB activity, Accessibility abuse, and AI-driven navigation patterns.

What You Should Do

1. Don't install APKs from outside the Play Store.

RatHat spreads through third-party portals and smishing links. Stick to official sources.

2. Be careful with SMS links.

If you get a text with a link you didn't expect, don't click it. Even if it looks like it's from a legitimate company.

3. Check Accessibility permissions.

Go to Settings > Accessibility. Look for apps you don't recognize. Remove them.

4. Watch for Developer Options being enabled.

If Developer Options or Wireless Debugging are turned on and you didn't do it, that's a red flag.

5. Use mobile threat defense.

Signature-based antivirus won't catch RatHat. Look for tools that monitor behavior.

6. If you think you're infected, factory reset.

Because RatHat survives uninstall, a factory reset may be the only way to remove it completely. Back up your data first, but be careful not to restore the malware.

The Bottom Line

RatHat is a new Android malware that uses AI and ADB self-pairing to control devices. It spreads through smishing and malvertising. It breaks out of the sandbox. It survives uninstall. And it can record everything you do.

If you're an Android user, be careful what you install. Check your Accessibility settings. Watch for Developer Options being enabled. And if you suspect infection, factory reset.

Quick Reference:

What to Do:

• Don't install APKs from outside Play Store
• Be careful with SMS links
• Check Accessibility permissions
• Watch for Developer Options
• Use mobile threat defense
• Factory reset if infected

FAQ Section

What is RatHat?

A new Android malware linked to China-based threat actors. It uses AI and ADB self-pairing to break out of the sandbox and control infected devices.

Spread method?

Via smishing, malvertising, and third-party app download sites. Users fall prey to downloading APK files infected with malware.

What can it do?

Steal credentials, record the screen, intercept SMS, log keystrokes, and more. It also survives uninstall.

How does the AI part function?

An AI assistant, which is generative, is used for navigating the device. It resolves screen coordinates and text to allow synthetic clicks and navigation.

What should I do if I am infected?

Since it survives uninstallation, the best thing to do would be to perform a factory reset. Make sure to backup your data but don't restore the malware.

Source: The Hacker News