RatHat: The Android Trojan That Controls the Infected Device with AI

Specialists at Zimperium zLabs have described a new Android malware family called RatHat. Its main distinguishing feature is a subsystem that uses a large language model to help operators remotely find their way around the screen of a compromised device. Based on the prompts, written in Chinese, the researchers suspect that the authors are connected to Chinese groups.

RatHat spreads through the channels typical of mobile Trojans: malicious advertising, SMS, and phishing sites offering an APK download that bypasses Google Play. Once installed, the malware abuses Accessibility permissions to gain broad privileges.

Taking control without an external computer

RatHat turns on developer mode and wireless debugging on its own, gaining shell-level access via ADB — without connecting to a computer. A similar technique has previously appeared in the ToxicPanda and RedHook families. Through ADB, it installs an agent written in Go (liblocal-service.so), which runs commands with ADB shell privileges, bypasses battery-usage restrictions, and ensures persistence. What's more, the agent and the main malware restore each other: removing one component triggers a reinstallation of the other.

A second agent (libmedia_codec.so) works as an FRP reverse-proxy client, maintaining a persistent tunnel to the attackers' server. The Trojan itself displays HTML overlays on top of banking and cryptocurrency apps, intercepts SMS messages and notifications (including one-time passwords), records text input, extracts addresses from the browser bar, and steals PIN codes, passwords, and pattern locks from the lock screen.

AI instead of rigid scripts

The most curious part is the interface automation engine. RatHat serializes Android's “accessibility tree” into XML and sends it to a popular AI assistant (which the report does not name). The model determines the coordinates of the center of the desired element, recognizes its actual on-screen text, and returns navigation commands such as SCROLL_DOWN. This approach makes automation far more flexible than hard-coded scripts: operators don't need to interact with the device in real time, and it's harder for security software to detect the activity.

Separately, the Trojan resists removal — it intercepts the uninstall confirmation dialog, cancels the procedure, and shows a fake Google Play overlay with a bogus error message. There are also anti-analysis tricks: corrupting the APK container, a manifest file bloated to 61 MB, and malformed DEX pseudo-instructions that break research tools.

The recommendations are standard: don't install APKs from third-party sources without explicit trust in the publisher, don't grant apps access to Accessibility, and regularly scan the device with Play Protect.

Source: Bleeping Computer