New AI Malware 'RatHat' Hijacks Android Devices

Android users face a significant digital threat from a new AI-powered malware named RatHat. Discovered by Zimperium, this malware tricks users into downloading seemingly legitimate apps through fake websites mimicking the Google Play Store. Once installed, it requests accessibility permissions, which it then exploits to unlock Wireless Debugging and gain ADB Shell permissions, effectively securing admin access to the device.

This admin access allows RatHat to install an AI-assisted agent that executes system commands for information theft and a proxy client to exfiltrate data to attackers. The malware primarily targets financial applications popular in China, like WeChat Pay and Alipay, but can affect other financial apps as well. Researchers have identified 162 infected apps reporting to a dozen attacker-controlled servers.

RatHat operates discreetly, capturing on-screen information like usernames and passwords, and can even recreate PINs and pattern unlocks by stealing raw touch input. It also intercepts SMS messages to capture security codes, making it capable of stealing almost any data. Detecting RatHat requires an antivirus scan, with Malwarebytes being a free option. However, due to its adaptive nature and ability to masquerade as other apps, standard antivirus methods are insufficient for removal.

The only effective method to eliminate RatHat is a complete factory reset of the Android device. This action removes the hidden secondary files that the malware installs, which antivirus applications cannot address. Uninstalling the malicious app alone is ineffective, as the malware can reinstall itself using its persistent admin access. To prevent infection, users should avoid clicking links from unknown sources, verify app sources in the Google Play Store, and critically, deny accessibility permissions to any suspicious applications.