A newly discovered Android malware called RatHat uses an AI-powered subsystem to automate device control — a technique that makes it significantly more adaptable than traditional script-based remote access tools. Researchers at Zimperium zLabs found the malware being distributed via malvertising, SMS lures, and phishing sites that trick users into sideloading APK files from outside the Google Play Store.
Like many Android malware families, RatHat abuses Android’s Accessibility Service to gain elevated control over the infected device. What sets it apart is the AI layer: RatHat serializes the live on-screen accessibility tree into XML and sends it to an AI assistant (not named in the report) to identify UI elements, determine their coordinates, and receive navigation instructions such as “SCROLL_DOWN.” This makes the malware’s behavior harder to fingerprint because it adapts dynamically rather than relying on fixed coordinates or scripted flows. Two embedded agents handle persistence (one restores the other if removed), a Go-based shell provides ADB-level command execution, and an FRP reverse-proxy tunnel keeps a channel open to the attacker. Beyond remote control, RatHat overlays fake login screens on banking and crypto apps to steal credentials, intercepts SMS and OTPs, records keystrokes, and captures lock-screen PINs. Zimperium links the campaign to Chinese threat actors based on LLM prompts found written in Chinese inside the malware.
How to check if you’re affected
Affected devices are any Android phone or tablet on which an APK was installed from outside Google Play. To check: open Settings → Accessibility → Installed services and look for any unfamiliar app that has been granted accessibility permissions — legitimate apps rarely need this. Also review Settings → Developer options; if Wireless Debugging is on and you did not turn it on yourself, that is a red flag. Android’s built-in Play Protect scanner can help detect known malicious APKs: open the Play Store, tap your profile icon, select Play Protect, and run a scan.