"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," comments Zimperium.
What RatHat is and how it spreads
Zimperium zLabs researchers describe RatHat as a newly discovered Android malware family that couples traditional mobile-attack techniques with an AI-powered subsystem to remotely navigate compromised devices. According to the analysis, RatHat is distributed via malvertising, SMS, and phishing sites that promote APK downloads from outside Google Play. The researchers also say the malware is likely linked to threat actors from China, based on LLM prompts found in Chinese.
AI-guided navigation engine
RatHat’s most distinctive feature is an AI-driven interface-automation module. Zimperium reports that the malware serializes the live Android Accessibility tree into XML and sends that snapshot to a popular AI assistant (unnamed in the report). The AI is tasked with locating interface elements — identifying center coordinates of a named element, determining an element’s on-screen text, and returning navigation instructions such as 'SCROLL_DOWN' and other commands. That capability lets operators automate navigation dynamically rather than relying on brittle, pre-written scripts, enabling remote control without continuous human input on the target device.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAbuse of Accessibility, Developer Options, and ADB for privilege
Like many Android threats, RatHat depends on granted Accessibility permissions to carry out high-privilege actions. The malware is reported to enable Developer Options and Wireless Debugging to gain ADB-like access locally — a technique previously seen in the ToxicPanda and RedHook families. With this local shell execution context, RatHat installs a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, creates battery-restriction bypasses, and manages persistence.
Dual-agent persistence and FRP tunneling
RatHat deploys at least two native agents. The Go-based liblocal-service.so functions both to execute privileged commands and to act as a restoration mechanism: it can restore the malware if it is removed or stopped, providing a persistence channel independent of the primary APK, and the malware similarly restores the agent if it is removed. A second component, libmedia_codec.so, acts as an FRP reverse-proxy client to establish a persistent tunnel to the attacker. Together, these agents provide mutual restoration and a long-lived remote access capability.
Data-stealing overlays, interception, and removal resistance
The malware displays HTML overlays targeted at banking and cryptocurrency applications to capture credentials. RatHat also intercepts SMS messages and notifications (including one-time passwords), records text-change events, extracts URLs from browser address bars, and captures lock-screen PINs, passwords, and unlock patterns. To frustrate attempts to remove it, the malware intercepts the uninstall confirmation screen, cancels the procedure, and presents a fake Google Play overlay with a bogus error message. Zimperium highlights multiple anti-analysis techniques as well — APK container tampering, a bloated (61MB) Android manifest file, and invalid DEX pseudo-instructions — deliberately designed to confuse or break automated analysis tools.
What this means for end users, security teams, and Google Play / Play Protect
- End users: The researchers recommend never downloading APKs from outside Google Play unless the publisher is explicitly trusted, avoiding granting Accessibility permissions to apps, and regularly scanning devices with Play Protect.
- Security teams and technologists: RatHat’s AI-driven navigation and dual-agent persistence mean incident responders should look for evidence of wireless debugging, unexpected native agents (liblocal-service.so, libmedia_codec.so), and overlay behaviors when investigating suspected infections.
- Google Play / Play Protect: Because RatHat is distributed from outside the store and uses overlays and ADB-level agents, store defenders and Play Protect detections will be focused on remote-automation indicators, APK tampering patterns, and large or malformed manifests that match the artifacts Zimperium observed.
Zimperium’s report frames RatHat as a step beyond scripted automation: an adaptable, AI-assisted toolset that combines interface understanding with native agents capable of restoring each other and maintaining a covert channel. For anyone who manages or uses Android devices, the practical takeaway the researchers offer is specific and simple — avoid sideloaded APKs, limit Accessibility permissions, and keep Play Protect scans current — because RatHat’s design aims precisely to exploit those gaps.
