RatHat Android Trojan Uses Live AI to Steal Logins and PINs

Researchers at Zimperium’s zLabs have analysed RatHat, an Android Trojan that uses a live AI assistant to navigate infected devices. Rather than relying on a fixed sequence of taps, the malware reads the accessibility tree to decide where to tap or scroll, creating a variable attack path that could make detection by signature- and rule-based tools more difficult.

The reported attack begins with smishing messages or malicious advertisements directing victims to fake download pages, where they are persuaded to sideload a malicious APK, sometimes disguised as a streaming app or Chrome.

RatHat then pressures users to grant Accessibility Service access, using excuses such as network restrictions or financial incentives. With that access, it enables Developer Options and Wireless Debugging, reads the six-digit pairing code from the screen and pairs with the device without further human or computer involvement. It uses the resulting ADB shell session to install disguised native binaries, including a Go-based command agent and a reverse-proxy client that maintains a tunnel to the attacker’s server.

The Trojan can overlay financial apps to steal logins, one-time passwords and MFA codes, while recording raw touch coordinates to reconstruct PINs and unlock patterns. It can also intercept SMS messages and restore itself after removal.

Users should avoid sideloading, reject unexplained accessibility requests, and leave Developer Options and Wireless Debugging disabled unless genuinely required. Malwarebytes detects RatHat as **Android/Trojan.Exploit.RatHat**. The report says an infected device requires a factory reset because the malware’s persistence can survive normal app removal.