Reported by 10 outlets

Timeline

1. original reporting

   AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes

   gbhackers.com · 24d ago · September 19th, 2026

   Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malware, which represents a significant evolution in Android threats. AI-Powered RatHat Android Trojan Unlike traditional malware that relies on fixed scripts, RatHat offers a […] The post AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   RatHat Android Malware Uses AI and ADB to Steal Banking Credentials and OTPs

   cyberpress.org · 26d ago · September 17th, 2026

   The malware uses artificial intelligence, Accessibility Service abuse, and Android Debug Bridge (ADB) pairing to steal banking credentials, payment PINs, one-time passwords, and lock-screen data. RatHat is spread through smishing messages, malicious advertisements, phishing websites, and third-party download portals. Victims are lured into manually installing APK files disguised as legitimate apps, including streaming services, browsers, and financial applications. Unlike common Android malware, RatHat does not rely only on its malicious app. It uses a multi-stage infection chain to gain shell-level access, deploy native tools, and remain active even after the victim removes the original application. RatHat Steals Banking OTPs After installation, RatHat attempts to convince victims to enable its Accessibility Service. It uses localized HTML pages and financial or network-related lures to obtain the permission. Once granted, the malware automates several sensitive actions. It opens Developer Options, taps the Build Number setting seven times, enables Wireless Debugging, and reads the ADB pairing code and port number displayed on the device screen. Phishing site distributing RatHat malware (Source: zimperium) RatHat then uses its embedded ADB library to pair with the device’s local ADB daemon. This gives the threat actors shell-level access without requiring a computer connected through USB. The malware deploys two Go-based binaries disguised as Android native libraries.

3. update from gbhackers.com

   RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

   gbhackers.com · 26d ago · September 17th, 2026

   RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation. The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs, one-time passwords, device-unlock secrets, and other high-value data from infected Android devices.

4. update from bleepingcomputer.com

   RatHat Android malware uses AI to automate device control

   bleepingcomputer.com · 26d ago · September 17th, 2026

   A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese. The researchers say the malware is distributed through malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play. Like most Android malware families, RatHat relies on abusing Android's Accessibility permissions to perform highly privileged actions on infected devices. Most notably, it enables Developer Options and Wireless Debugging to gain a local shell-level execution context without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families. ADB access lets RatHat install a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, creates battery-restriction bypasses, and manages persistence. The same agent also restores the malware if it's removed or stopped, providing a persistence channel independent of the malware itself. This back-up goes both ways, with the malware restoring the agent if it's removed. The Go agent's keylogging activity Source: Zimperium A second agent (libmedia_codec.so) also acts as an FRP reverse-proxy client, establishing a persistent tunnel to the attacker. The malware displays HTML overlays for targeted banking and cryptocu

5. update from www.bleepingcomputer.com

   New RatHat Android malware uses AI to automate device control https:// bleepingcomputer.com/news/security/ new-rathat-android-malware-uses-a

   www.bleepingcomputer.com · 26d ago · September 17th, 2026

   New RatHat Android malware uses AI to automate device control https:// bleepingcomputer.com/news/security/ new-rathat-android-malware-uses-a

   via X https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/

6. mentioned by www.bleepingcomputer.com

   🤖 New Android malware "RatHat" uses an AI-powered subsystem to help operators remotely navigate compromised devices, automating device contr

   www.bleepingcomputer.com · 26d ago · September 17th, 2026

7. mentioned by cyberworldops.eu

   Zimperium zLabs identified RatHat, a China-linked Android malware abusing Accessibility and local ADB to maintain persistence via native dae

   cyberworldops.eu · 25d ago · September 18th, 2026

8. update from securityaffairs.com

   # RatHat Turns Android Accessibility Into an Attack Weapon https:// securityaffairs.com/199317/mal ware/rathat-turns-android-accessibility-i

   securityaffairs.com · 25d ago · September 18th, 2026

   RatHat Turns Android Accessibility Into an Attack Weapon https:// securityaffairs.com/199317/mal ware/rathat-turns-android-accessibility-i

   via Mastodon https://securityaffairs.com/199317/malware/rathat-turns-android-accessibility-into-an-attack-weapon.html

9. update from malware.news

   Android malware uses AI to steal bank logins and PINs

   malware.news · 25d ago · September 18th, 2026

   What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script. The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan. By turning on Wireless Debugging, RatHat can escape the normal app sandbox. The attack The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline. Victims are lured through smishing (SMS phishing) texts and malicious ads that lead to fake download pages, sometimes disguised as a popular streaming app or even a browser like Chrome. These pages trick people into sideloading a malicious APK (Android Package Kit). Once installed, the app pressures the user into enabling Android’s Accessibility Service, using a fake “network restriction” excuse or bogus fi

10. update from cyberpress.org

    RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

    cyberpress.org · 24d ago · September 19th, 2026

    RatHat Android Malware According to MalwareBytes , RatHat differs from traditional Android malware because it does not rely solely on pre-programmed automation scripts. Instead, it provides a live AI assistant with access to the Android accessibility tree, allowing it to interpret the content displayed on the victim’s screen and dynamically decide where to tap, scroll, or input data. This AI-driven interaction model makes RatHat more difficult to detect. Conventional mobile security products typically identify malicious activity based on fixed behavior patterns, known overlay templates, or hardcoded automation sequences. In contrast, RatHat can vary its navigation path depending on device settings, installed applications, and the screens presented to the user. Victims are redirected to fraudulent download pages that impersonate trusted applications, such as streaming platforms or popular web browsers.

11. mentioned by gbhackers.com

    RatHat, an Android trojan targeting bank credentials, PINs and MFA codes — with AI-assisted behavior to bypass detection. The interesting pa

    gbhackers.com · 24d ago · September 19th, 2026

12. mentioned by www.bleepingcomputer.com

    New # RatHat # Android # malware uses # AI to automate device control https://www. bleepingcomputer.com/news/secu rity/new-rathat-android-ma

    www.bleepingcomputer.com · 24d ago · September 19th, 2026

13. mentioned by gadgetflux.eu

    RatHat: the AI-powered Android malware that can steal passwords, banking data, and 2FA codes https:// gadgetflux.eu/rathat-noul-malw are-ai-

    gadgetflux.eu · 23d ago · September 20th, 2026

14. update from www.cnet.com

    Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem - CNET https://www. cnet.com/tech/services-and-sof tware/rathat

    www.cnet.com · 23d ago · September 21st, 2026

    Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem - CNET https://www. cnet.com/tech/services-and-sof tware/rathat

    via Mastodon https://www.cnet.com/tech/services-and-software/rathat-malware-attacks-android-phones/

15. update from securityweek.com

    RatHat Android Trojan Uses AI for Automation

    securityweek.com · 22d ago · September 21st, 2026

    RatHat contains typical mobile malware capabilities: it steals users’ credentials, mimics banking and payment applications to steal credentials and access codes, and establishes a covert communication channel with the command-and-control (C&C) server for remote access. It also grants itself administrator-level permissions to access system functions, and installs a separate hidden background service to reinstall itself and restore its permissions. The AI prompts used by the malware suggest it was developed by a Chinese threat actor. RatHat, Zimperium says, is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions. Its architecture consists of three parts: a malicious Android application, a Go agent, and an FRP client. The application gains critical system permissions, boo