RatHat Android Malware Employs AI and ADB Abuse for Persistent Banking Credential Theft
A new Android malware named RatHat, potentially linked to Chinese actors, steals banking PINs and verification codes via fake overlays and SMS interception, while exploiting Accessibility and Developer Options to achieve persistent ADB shell-level access and self-reinstallation.
A sophisticated new Android malware, dubbed RatHat, has emerged with a multi-pronged attack strategy targeting banking customers. This threat actor employs deceptive tactics, including fake login screens and SMS interception, to harvest sensitive banking credentials such as PINs, passwords, and one-time verification codes. The ultimate goal is to facilitate account takeovers and unauthorized transactions, leaving victims vulnerable even after they believe the malicious application has been removed.
The infection chain for RatHat begins with users being lured to install a seemingly legitimate Android application package. This is often achieved through phishing text messages, malicious advertisements, or third-party forums. Once installed, the malware prompts the user to grant extensive Accessibility permissions, a common technique used by advanced Android malware to gain deep system control. Researchers at Zimperium have linked the operators of RatHat to threat actors believed to be operating out of China, noting similarities in infection vectors to previous campaigns like ToxicPanda.
RatHat's technical prowess lies in its exploitation of Android's Accessibility and Developer Options. After obtaining Accessibility access, the malware leverages automated taps to enable Developer Options and Wireless Debugging. It then reads the pairing code and port displayed by Android to establish a connection with the device's local ADB (Android Debug Bridge) service. This grants RatHat shell-level access, a privilege typically reserved for system-level operations and not accessible by standard applications, enabling extensive control over the device.
Further enhancing its capabilities, RatHat installs two disguised native components within a system directory. One component acts as a local agent responsible for managing permissions and altering background settings, while the other establishes a reverse connection, exposing the device to the operator for remote control. This abuse of Wireless Debugging is not entirely novel, as similar techniques have been observed in other ADB-abusing malware like RedHook.
One of RatHat's most alarming features is its remarkable persistence. The malware can present a false failure screen when a user attempts to uninstall it, tricking them into believing the process was successful. However, even if the uninstallation appears to complete, the local agent component remains active outside the app's normal lifecycle. RatHat actively monitors for its presence and will automatically reinstall the APK package and restore all previously granted permissions without user consent, effectively thwarting standard cleanup efforts.
Beyond its persistence, RatHat employs advanced techniques for credential harvesting. It utilizes fake web-based overlays that convincingly mimic legitimate banking, cryptocurrency, and payment applications. When a targeted app is launched, RatHat can superimpose a convincing fake screen to capture user input. It also monitors touch coordinates, enabling it to infer digits entered on a PIN pad or movements used for pattern unlocks. The malware even sends a live map of the phone's interface to a generative AI assistant, allowing for narrow automation tasks like identifying buttons or reading on-screen text, which helps it adapt to different screen layouts and languages.
Defending against RatHat requires a multi-layered approach. Users are strongly advised to download applications exclusively from official app stores, exercise caution with unsolicited messages and advertisements, and critically evaluate requests for Accessibility permissions. Regularly reviewing enabled services and Wireless Debugging settings on Android devices is also crucial. Banks and financial institutions should monitor for suspicious sessions exhibiting screen overlays, accessibility scraping, or active debugging services, and implement additional verification steps for high-risk transactions. Relying solely on SMS-based multi-factor authentication is insufficient, as RatHat is specifically designed to intercept these codes.
This new report from Infosecurity Magazine provides further technical details on the RatHat malware, specifically highlighting its use of generative AI, potentially Google's Gemini models, to interpret Accessibility Service data and automate user interactions like synthetic clicks and scrolling. It also elaborates on the malware's distribution methods, including malvertising and smishing, and its multi-layered anti-analysis techniques.