Reported by 2 outlets
RATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of Devices
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
RATHat is an Android banking trojan that pairs Google Gemini AI with Android Debug Bridge (ADB) abuse to steal credentials and give attackers remote device control. The malware spreads through malicious ads, SMS phishing, and deceptive download pages disguised as cryptocurrency trading or streaming apps. After installation, it abuses Accessibility Service access to enable Developer Options and wireless debugging, reads the pairing code from the screen, and connects to the local ADB daemon under Android UID 2000 without an external computer. Operators then deploy a native Go service into /data/local/tmp that maintains its own command-and-control channel and runs a reverse tunnel through an FRP client, giving remote shell access separate from the original malicious app.
The Gemini component navigates unfamiliar Android interfaces automatically, reducing operator workload and making the malware more adaptable. The operator panel applies AI to identify higher-value victims from stolen SMS data, which means campaigns are actively prioritized rather than random. Target regions include Europe, Latin America, and Southeast Asia. This is a notable shift: generative AI is no longer just a developer convenience but an embedded malware capability that increases both automation and targeting precision.
There is no specific CVE assigned to RATHat because it is malware, not a product vulnerability. The defense priority is user awareness and endpoint protection: restrict sideloading, monitor for Accessibility Service abuse followed by Developer Options activation, and scan for unexpected ADB wireless pairing events and processes running from /data/local/tmp. Watch for additional variants that integrate newer AI models and expand target geography beyond the current campaign footprint.
Timeline
-
original reporting
RATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of Devices
cyberpress.org · 13d ago · September 30th, 2026
RATHat, an Android banking trojan, combines Google Gemini AI with Android Debug Bridge (ADB) abuse to steal credentials and give attackers remote access. Its malicious application acts as an entry point, deploying a separate service that operates outside the app’s normal lifecycle. The malware spreads through malicious advertising, SMS phishing, and deceptive download pages. Campaigns described in the supplied analysis target Europe, Latin America, and Southeast Asia. Earlier samples used cryptocurrency trading and streaming application disguises to persuade victims to install malicious APK files. Unlike a conventional banking trojan, RATHat does not depend entirely on permissions held by its installed application. It abuses Accessibility access to create an additional control layer through the device’s own debugging interface. RATHat Hijacks Android Devices The infection chain depends on the victim granting Accessibility Service access. RATHat then navigates Android settings, enables Developer Options and wireless debugging, and reads the pairing code displayed on screen. It pairs with the local ADB daemon without requiring an external computer. This connection provides shell access under Android’s UID 2000. Operators can then deploy a native Go service into /data/local/tmp . RATHat Architecture (Source: cleafy) The service runs separately from the application and maintains its own communication channel with the command-and-control infrastructure. An FRP client creates a rev
-
update from gbhackers.com
Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks
gbhackers.com · 13d ago · September 30th, 2026
A newly documented Android banking trojan named RATHat is demonstrating how generative AI can be operationalized inside mobile malware. The threat uses Google Gemini models to navigate unfamiliar Android interfaces, while its operator panel applies AI to identify higher-value victims from stolen SMS data. The malware disguises itself as legitimate applications, then relies on social […] The post Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .