Android RatHat Trojan Uses AI and Wireless Debugging to Steal PINs

Zimperium researchers have detailed RatHat, an Android trojan reportedly linked to China-based operators. It is distributed through deceptive phishing sites, malvertising, smishing and third-party forums, where victims are persuaded to install malicious APKs. The malware hides its payload in encrypted files, uses reflection to load a second-stage DEX file in memory, and abuses Android’s SessionInstaller APIs to evade installation and Accessibility Service restrictions.

It also employs extensive anti-analysis measures, including a 61 MB `AndroidManifest.xml`, invalid pseudo-instructions, encrypted strings and checks for debuggers, Frida, Xposed, root access and emulators.

After obtaining Accessibility Service access, RatHat can enable Developer Options and Wireless Debugging, read the ADB pairing code from the screen and pair with the phone’s own debugging interface without a cable or additional device. It installs Go-based components that expose an ADB shell through a reverse-proxy tunnel. The malware can then log text through Accessibility, extract browser URLs, and read raw touch coordinates from `/dev/input`, using brand-specific keypad layouts to infer PINs.

It overlays fake screens on banking, payment, WeChat and Alipay applications, intercepts SMS-based two-factor codes, and communicates with command-and-control infrastructure over HTTP and WebSocket connections.

A notable feature is its use of a generative AI assistant: RatHat sends the device’s Accessibility tree as XML and receives coordinates, text or navigation instructions to automate interaction as screen layouts change. The malware can also resist removal by displaying a fake Google Play error and, if uninstalled, using an external agent to reinstall itself and restore permissions.

Zimperium said the initial requirement for Accessibility access remains a key weakness; users should not grant that permission to apps without a clear and legitimate need.