Security researchers at Zimperium have discovered a new Android malware strain targeting credential and bank detail harvesting.
The malware, named RatHat by the researchers, is linked to threat actors that appear to be operating in China.
It incorporates novel techniques for persistence and leverages generative AI for operational control.
RatHat’s Delivery: Smishing, Malvertising and Malicious App
RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
The threat actors behind the malicious campaign use these channels to lure victims into manually downloading malicious Android package kits (APKs) that appear to be legitimate apps.
Once deployed, the malicious app deploys RatHat via a dropper that carries the payload in two encrypted assets.
The dropper exploits native SessionInstaller APIs to bypass Android’s restricted settings and Accessibility Service protections, enabling the installation of the malicious payload and subsequent access to protected APIs.
The malware also contains four anti-analysis layers and one anti-debug layer to bypass Android’s security controls.
RatHat’s Architecture Explained
The architecture of the RatHat malware can be broken down into three primary operational parts:
- Malicious Android application
- Go agent (liblocal-service.so)
- FRP client (libmedia_codec.so)
The app’s main role is to act as the primary interface with the user, acquire critical system permissions and bootstrap the rest of the infection chain.
The app carries spyware capabilities, with the capacity to collect banking credentials, notifications, two-factor authentication (2FA) and one-time-password (OTP) keys, and capture screen and inputs.
In a malware analysis published on September 16, Zimperium’s zLabs team noted a particularly interesting feature in the malicious app: a generative AI user interface-automation engine.
In practice, RatHat serializes the target device's live Accessibility tree to XML and communicates in Mandarin with “one of the world’s most popular generative AI assistants,” the researchers noted.
This AI tool is used for non-malicious actions including:
- Resolving a named target's centre coordinates on the screen as JSON to direct synthetic clicks
- Resolving a target's actual on-screen text from the XML (without translating)
- Signaling automatic navigation commands like SCROLL_DOWN
While the researchers did not specify which AI tool is used in the report, they provided a graph suggesting the threat actors used Google’s Gemini AI models.
The prompts used by RatHat operators in the zLabs investigation are the main indicator of potential China-based threat actors.
The Go agent is the privileged command-and-control (C2) executor that runs commands through the local ADB shell context to bypass app-level security restrictions.
It handles critical system-level tasks like exempting the app from battery optimization/Doze mode, prioritizing its background execution and disabling or uninstalling other packages (like security apps), while also fetching the FRP client's configuration from the C2 server.
Finally, the FRP client establishes a persistent, secure reverse tunnel from the infected device back to the attacker's C2 server. Its sole purpose is to give attackers ongoing remote access to the device's ADB daemon, acting as a general-purpose backdoor that can carry arbitrary commands independent of the malware's built-in features.
“RatHat’s multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient,” the zLabs report noted.