Researchers found a new Android malware family called RatHat that can remotely control infected phones and steal banking, cryptocurrency, and account data. Zimperium says it spreads through malvertising, SMS, and phishing pages pushing off-Play APKs, abuses Accessibility permissions, enables Developer Options and Wireless Debugging for Android Debug Bridge (ADB) shell access, installs Go-based persistence agents, uses overlays to phish credentials, and sends Accessibility screen data to an AI assistant to automate navigation.
Why it matters: This raises the risk for Android users who sideload apps, especially people using banking and crypto apps, because the malware can steal passwords, one-time codes, and lock-screen secrets while resisting removal. The practical takeaway is to avoid APKs from outside Google Play, deny unnecessary Accessibility permissions, and scan devices with Play Protect or mobile security tools.
Bill Toulas
2026.09.17
100% relevant
This article appears to be the first tracked report establishing RatHat as a distinct Android malware family with AI-assisted interface automation and credential theft capabilities.
← Back to all stories