An AI-Piloted Android Trojan
Mobile security firm Zimperium has identified RatHat, an Android trojan that hands control of on-device navigation to a generative AI model. Rather than relying on hardcoded scripts to locate buttons and fields across the huge variety of banking and payment apps it targets, RatHat serializes the device's live Accessibility tree to XML and feeds it to an AI model, which reads the on-screen content and decides how to interact with the interface in real time — significantly increasing the malware's adaptability and its ability to evade detection tuned to fixed automation patterns.
What It Does
RatHat's core objective is credential theft and account takeover, using a familiar Android trojan playbook amplified by AI-driven automation:
- PIN and password reconstruction via hardware-level touch monitoring
- Multiple keylogging mechanisms — Accessibility event monitoring, browser address-bar reading, and raw screen-touch coordinate extraction
- WebView overlay injection to display fake banking and payment app interfaces over legitimate ones
- SMS interception and abuse of Device Admin permissions
- Self-reinstallation if the app is removed, with a background shell service that persists even after uninstallation
- Local ADB daemon access, enabling shell-level command execution on the infected device
Technical Architecture
RatHat is built from three components: the malicious Android application itself, a Go-based agent that acts as the command-and-control brain, and an FRP reverse-proxy client that gives the operators secure ADB access for remote shell execution. That combination gives attackers something closer to full remote control of the device rather than just data exfiltration.
Attribution
Zimperium says AI prompts embedded directly in the malware's code point toward a Chinese-speaking threat actor, though the firm stopped short of formal nation-state attribution.
Why This Matters
RatHat is part of a pattern CosmicBytez Labs has been tracking all year: mobile and desktop malware authors adopting AI models not just to generate their code, but to run inside the malware as an operational component — reading screens, making navigation decisions, and adapting to unfamiliar app layouts on the fly. That shift matters for defenders because it breaks the assumption that automation-based malware detection can rely on fixed interaction sequences; an AI-piloted trojan can improvise its way around a UI it has never seen before. Mobile security teams should treat unusual Accessibility Service permission requests as a high-priority signal, especially combined with WebView overlay behavior.