RatHat: A New Android Malware Family That Uses AI to Navigate Your Phone
Most Android banking trojans rely on the same trick: a fixed script that taps through a phone's screen in a predictable sequence. That approach breaks the moment an app changes its layout. A newly identified malware family called RatHat gets around that limitation by handing the navigation problem to an AI model instead of a script.
How RatHat actually works
Security researchers at Zimperium zLabs, along with reporting from BleepingComputer and SecurityWeek, describe RatHat as using an AI-powered interface-automation engine. Instead of hard-coded taps and swipes, the malware serializes the live Android Accessibility tree — the structured representation of everything on screen — into XML and sends it to an AI assistant, which then decides how to navigate the device. That makes the automation adaptable to whatever screen it lands on, rather than brittle and app-version-specific like older remote-access trojans.
Once it has that level of control, RatHat's capabilities read like a checklist of what a remote attacker would want: intercepting SMS messages and notifications (including one-time passwords used for two-factor authentication), recording text as it's typed, pulling URLs out of the browser's address bar, and capturing lock-screen PINs, passwords and unlock patterns. For banking and cryptocurrency apps specifically, it displays HTML overlays on top of the real app to capture login credentials directly.
Researchers also found the malware can re-establish itself after being removed, and that it can enable Developer Options and Wireless Debugging on an infected device to get local shell-level execution — without needing an attacker's computer physically connected. Zimperium researchers linked it to threat actors likely based in China, after finding the AI prompts embedded in the malware written in Chinese.
How it spreads
RatHat isn't distributed through the Google Play Store. Reported infection paths are malvertising, SMS phishing, and phishing sites that push APK downloads directly — the same "install this app from a link, not a store" pattern that most serious Android malware still relies on, because it sidesteps Play Store review entirely.
Why the AI angle matters more than the malware itself
Malicious apps that abuse Android's Accessibility permissions to control a device are not new — that category has existed for years. What's genuinely new here is outsourcing the "figure out what's on screen and what to tap" problem to an AI model instead of writing app-specific automation scripts. That is a meaningful jump in how adaptable this class of malware can be, and it is a preview of a pattern likely to show up elsewhere: attackers using general-purpose AI reasoning to make older attack techniques survive UI and version changes that used to kill them.
What this means practically
For most people and teams, the defense here hasn't changed, but it matters more than usual given how convincing RatHat's overlays and automation can be:
- Only install Android apps from the Play Store. RatHat's entire distribution chain depends on getting a user to install an APK from outside it.
- Be suspicious of any app requesting Accessibility permissions unless it's a tool that has a clear, legitimate reason to need them (screen readers, some password managers). Very few apps genuinely need this permission.
- Treat unexpected login prompts inside a banking or crypto app as suspicious, especially if the app was just opened normally — overlay attacks are designed to look identical to the real login screen.
- Enable Play Protect and keep it on; it's Android's built-in scanning layer for exactly this kind of malware.
None of this is new advice, but RatHat is a concrete, current reminder of why it still holds: the weak point is almost always the install source, not a flaw in Android itself.
