RatHat Android Malware Uses AI to Navigate Phones and Keeps Shell Access After Removal

A newly documented Android malware called RatHat uses an AI assistant to steer itself through a phone’s interface and keeps shell access to the device even after the app is uninstalled. Zimperium’s zLabs researchers linked it to China-based operators after finding LLM prompts written in Chinese, BleepingComputer reported.

The malware primarily targets apps such as WeChat Pay and Alipay, though other financial apps can also be hit, and researchers have found 162 infected apps in the wild reporting to a dozen attacker-run servers, according to CNET. It spreads through malvertising, SMS and phishing sites that offer APK downloads outside Google Play, often disguised as apps like Chrome.

From accessibility to a local ADB shell

Once installed, RatHat pushes the user to grant accessibility permissions, then uses them to unlock Developer Options and turn on Wireless Debugging. That gives it a shell-level foothold through the phone’s own ADB daemon without an external computer, a technique also seen in the ToxicPanda and RedHook families.

The AI piece handles navigation. “The malware serializes the device’s live Accessibility tree to XML and communicates with one of the world’s most popular Generative AI assistants,” Zimperium said, as quoted by The Hacker News. The researchers said the AI is used for non-malicious steps such as finding the screen coordinates of a named button so the malware can click it. The assistant isn’t named in the report.

RatHat then runs a Go agent disguised as a native library, liblocal-service.so, which uses the ADB shell to set up persistence and power-management exemptions. A second component acts as an FRP reverse-proxy client, opening a persistent tunnel to the operators. Because that access lives outside the app, attackers keep shell access even if the victim uninstalls it and can reinstall the malware if it’s missing. RatHat also tries to block removal by intercepting the uninstall screen and showing a fake Google Play error.

What it steals

The malware can overlay fake login screens on targeted apps, record the screen through Android’s MediaProjection API, intercept SMS messages and notifications including one-time passwords, log keystrokes and URLs typed into browsers, and capture lock-screen PINs, passwords and unlock patterns. CNET noted it can also read raw touch input to reconstruct PINs and pattern codes. Zimperium also found anti-analysis tricks, including APK container tampering, a bloated 61MB Android manifest and invalid DEX pseudo-instructions.

A Google spokesperson said no apps containing the malware were found on Google Play and that Play Protect, on by default on devices with Google Play Services, protects against known versions. Because infection requires sideloading, the main defenses are avoiding APKs from unknown sources, being wary of SMS and email links, refusing unexpected accessibility requests and treating any prompt to “reinstall” an app like Chrome that’s already on the phone as a red flag.