RESEARCHERS at Zimperium’s zLabs have analysed RatHat, an Android Trojan that uses a live AI assistant to control infected devices. Rather than following a fixed sequence of taps, the malware reads the Android accessibility tree to decide where to tap and scroll, creating a variable attack path that may hinder signature- and rule-based detection.
The campaign reportedly begins with smishing messages or malicious adverts leading to fake download pages, where victims are persuaded to sideload a malicious APK disguised as a streaming app or browser.
RatHat tricks users into enabling Android’s Accessibility Service, then uses that access to open Developer Options, activate Wireless Debugging and read the six-digit pairing code from the screen. It pairs with the device itself through Android Debug Bridge (ADB), drops a Go-based command agent and a reverse-proxy client, and establishes a tunnel to the attacker’s server. The Trojan can display overlays over financial applications to steal logins, one-time passwords and MFA codes.
It can also capture raw touch coordinates to reconstruct PINs and unlock patterns, intercept SMS messages, control the device semi-autonomously and restore itself after removal. Malwarebytes detects it as **Android/Trojan.Exploit.RatHat**. Users should avoid sideloading, reject unrelated accessibility requests and leave Developer Options and Wireless Debugging disabled unless needed. An infected device requires a factory reset because RatHat’s persistence may survive normal app removal.