A new mobile threat has handed the boring part of phone hijacking to an AI model. Researchers at Zimperium have pulled apart RatHat, an Android malware family with an unusual trick. It ships live screen data to a well known AI assistant, then asks the model where to tap next. Scripted phone trojans break when an app changes its layout, but this one adapts on the fly.
Every infection starts with Android’s Accessibility service, a tool built to help users with disabilities. Once a victim grants that permission, the RatHat Android malware reads the screen, taps buttons, and approves its own requests. It then turns on Developer Options and Wireless Debugging. That pairing hands it a shell on the phone, with no computer plugged in.
Shell access lets it install a Go-based agent called liblocal-service.so. The agent runs commands with high privileges and kills battery limits that would otherwise stop background activity. A second file works as a reverse proxy, holding a tunnel open to the attacker’s server. Older families such as ToxicPanda and RedHook used the same trick, though RatHat leans on it harder.
The AI reads the screen and sends back coordinates
But the automation engine sets this campaign apart from ordinary overlay trojans. RatHat turns the live Accessibility tree into XML, then ships that file to an AI assistant. The tree works as a map of every button and label on screen. Still, researchers chose not to name the AI tool involved.
The model answers with the exact coordinates of a button, the text printed on it, and commands like SCROLL_DOWN. So an operator can steer a stranger’s phone using plain instructions. Older banking trojans leaned on fixed coordinates and screen templates instead. One small app update moved a button, and the whole attack fell apart.
An AI that reads the screen fresh each time adapts on its own. It also leaves fewer repeat patterns for security tools to spot. Zimperium found the prompts written in Chinese, which points to Chinese-speaking operators. That makes the RatHat Android malware harder to catch than the scripted tools defenders know well.
What the RatHat Android malware steals
Credential theft runs through HTML overlays that copy banking and crypto apps. A fake login screen drops on top of the real one, then grabs whatever the victim types. The RatHat Android malware also reads SMS messages and alerts, so one-time codes reach the attacker in seconds. Text message security codes offer almost no protection here.
The collection net stretches well past login forms and fake banking screens. RatHat logs text as users type, pulls web addresses from the browser bar, and captures lock-screen PINs and unlock patterns. With the screen lock in hand, an operator can wake a device at 3am and open banking apps directly. Stolen crypto rarely comes back, because nobody can reverse a blockchain transfer.
Why removal is so hard
Victims who spot the infection run into a second wall. The RatHat Android malware watches for the uninstall screen, cancels the action, and shows a fake Google Play error. Most people read that as a glitch rather than sabotage. So a factory reset is often the only clean way out.
Persistence also runs in both directions, which makes cleanup harder. Delete the malware and the Go agent puts it back. Remove the agent and the malware restores it. Researchers found anti-analysis tricks too, such as a tampered APK and a bloated 61MB manifest file.
How the RatHat Android malware spreads
Infections start with malvertising, SMS lures, and phishing pages that push APK files from outside Google Play. None of that needs a flaw in Android, since the victim installs the app. Attackers only need a good excuse, such as a fake delivery notice or a bank alert. So sideloading stays the single biggest risk for Android users.
Fake download pages copy the look of a real store, down to the icons and review counts. Because the file arrives outside Google Play, no automatic review sits between the ad and the install. Anyone chasing a free copy of a paid app walks straight into that gap. The lure works on careful people too, since a delivery text looks ordinary on a busy day.
Practical steps that actually help
Refusing sideloaded APKs removes most of the exposure to the RatHat Android malware. Play Protect still catches plenty of known threats, so leave it switched on. Accessibility permissions deserve real caution, because very few honest apps need them. When a flashlight app asks for that access, the request itself is the warning.
Network habits matter just as much on the delivery side. For example, many lures arrive through malicious ads and lookalike domains. A VPN with DNS filtering blocks part of that traffic before the page ever loads. Moving bank logins to app-based codes or a hardware key also closes the SMS hole that RatHat depends on.
Anyone who has already sideloaded apps should open the Accessibility settings menu first. Any entry there that does not match a familiar app deserves removal right away. However, a phone that blocks the uninstall needs a full reset instead of more troubleshooting. Backing up photos and contacts before that step saves a lot of pain later.
Final Thoughts
The RatHat Android malware points to where mobile crime is heading. An operator can now describe an action in plain words and let a model do the tapping. So the skill needed to run a fraud campaign drops fast, and defenders lose an easy signal. The basic advice has not changed: install from Google Play, refuse Accessibility prompts, and distrust apps that fight removal.
