Researchers from Zimperium’s zLabs labs discovered a new Android malware strain called RatHat, which uses an AI-powered subsystem to help its operators navigate infected devices and execute remote commands. According to the researchers, the malware spreads through malvertising, text messages, and phishing websites promoting APK files outside the Google Play Store.
The researchers believe RatHat may be linked to threat actors from China after finding prompts directed at large language models and written in Chinese. However, this observation does not represent definitive attribution of the campaign or its operators, but rather evidence within the malware analysis.
Deeper Control Through Android Permissions
Like other Android malware families, RatHat relies on the abuse of Accessibility Service permissions to perform highly privileged actions. More importantly, it enables Developer Options and wireless debugging, allowing it to establish a local execution context with ADB shell-level privileges without requiring an external computer, in a technique resembling mechanisms seen in ToxicPanda and RedHook malware.
After obtaining ADB access, the malware installs a Go-based client inside the liblocal-service.so file. This client executes commands with ADB shell privileges, bypasses battery restrictions, and manages persistence mechanisms on the device. It can also restore the malware if it is removed or stopped, while RatHat can in turn reinstall the client, creating a mutually redundant backup channel for persistence.
A second client, libmedia_codec.so, operates as an FRP reverse proxy client to create a persistent tunnel connecting the device to the attacker.
What Does AI Add?
RatHat serializes Android’s live Accessibility tree in XML format, then sends it to an AI assistant that Zimperium’s report did not name. The system is asked to identify the center coordinates of a specific interface element, extract the text actually displayed, and return navigation instructions such as SCROLL_DOWN.
In practice, this approach allows the malware to handle changing interfaces more flexibly than scenarios relying entirely on fixed text, while also reducing the need for direct and continuous operator interaction. Zimperium says this makes control more adaptive and could make it harder to detect than traditional automation based on predefined actions.
Data Theft and Resistance to Removal
RatHat displays HTML overlays over banking and cryptocurrency applications to lure victims into entering account details. It also intercepts text messages and notifications, including one-time passcodes, records text-change events, extracts URLs from the browser bar, and captures PINs, passwords, and unlock patterns.
The malware intercepts the uninstall confirmation screen to cancel the process, then displays a fake overlay mimicking Google Play and presents a false error message. In addition, it uses several anti-analysis techniques, such as tampering with the APK container, an oversized Android manifest file measuring 61 megabytes, and fake or invalid DEX instructions intended to confuse or disable analysis tools.
What Does This Mean for Users?
The use of AI alone does not prove that the malware bypasses all security measures, but it changes the practical weakness: control does not rely solely on fixed paths that can be predicted. Therefore, application installation sources and Accessibility permissions remain critical factors. Zimperium recommends not installing APK files from outside Google Play unless the publisher is explicitly trusted, avoiding granting Accessibility permissions to unnecessary applications, and conducting periodic scans with Play Protect.