THE RatHat Android banking Trojan has evolved its command-and-control (C2) infrastructure far more rapidly than the malware itself, Cleafy reports. Since April 2026, nearly 100 distinct deployments have been observed, underscoring a malware-as-a-service (MaaS) model in which operators can use a three-generation C2 panel to build, manage and tailor new samples.
The C2 panels have progressed from BlackCat to Panda Workshop, with the current generations enabling the operator to sign and publish Android samples directly from the console, and even regenerate samples on a schedule to evade hash-based detections while keeping the implant largely unchanged. Panda Workshop V5 introduced two-factor authentication for operators, and V6 added a phishing download-page builder.
The panels also support account limits and role-based access that mirror commercial MaaS functionality, indicating customers can run their own RatHat instances across campaigns in Europe, Latin America and Southeast Asia. Notably, a Singapore-based network hosts around half of observed attacker IPs.
The latest research also reveals sophisticated abuse of the RATHat framework beyond the Android app. Operators can deploy a native Go service via wireless debugging access with a single click, gaining shell-level control outside the app’s permission model, and this service can remain active after the app is removed until the next reboot.
Cleafy notes the C2 uses Gemini to analyse collected SMS messages and estimate victims’ bank balances to prioritise targets, while the implant can forward screen data to a large language model to determine where to tap when static automation fails. Although nothing observed performed fraudulent transfers, the study warns such techniques could revive automated transfer systems in future campaigns.