Researchers at Zimperium zLabs have identified a new Android malware family named RatHat that incorporates artificial intelligence to target users, a discovery reported by Bleeping Computer.
According to the analysts, Chinese actors are likely behind the malware: this assessment is partly based on the large language model (LLM) used by the program, which accepted Chinese commands. RatHat was distributed via fake advertisements, fraudulent SMS messages and phishing websites, using an APK installer distributed outside the Google Play Store.
How it works and permission abuse
RatHat abuses Android accessibility features to gain access to devices and execute commands. With the acquired privileges it installs an agent on the device that can bypass certain restrictions and ensures the malware’s persistence: the agent reinstalls the malware after each removal attempt.
The malware presents a fake HTML page inside targeted banking and cryptocurrency apps to capture users’ login credentials. The attackers also ensured RatHat can read incoming SMS messages and one-time passcodes (OTPs), allowing it to circumvent two-factor authentication.
Other data-theft capabilities include collecting links opened in browsers, stealing passwords, and obtaining the device unlock PIN.
The role of AI
The artificial intelligence component automates much of the malicious activity, removing the need for an attacker to perform manual steps. The AI can issue instructions, navigate the device and control functions, which makes detection by security software more difficult. The operators implemented several techniques to make the malware hard to remove.
Mitigation
Security researchers emphasize caution: do not install applications from unknown sources. Prefer downloading apps from the Google Play Store and rely on software from recognized developers when possible.
(The article’s lead image is illustrative; the reporting is based on Bleeping Computer and analysis by Zimperium zLabs.)
