AI-powered malware hijacks Android phones

A sophisticated Android malware named RatHat employs generative AI to achieve extensive control over user devices. Security researchers identified that this threat can steal sensitive banking credentials, intercept authentication codes, and even reconstruct PINs or unlock patterns by analyzing finger touch coordinates on the screen.

RatHat initiates its attack through social engineering, spreading via malicious advertisements and deceptive download sites. Once installed, it manipulates users into enabling Android's Accessibility Service. This permission allows the malware to enable Developer Options and Wireless Debugging, granting it ADB shell-level access outside the standard app sandbox.

The malware's AI component helps it navigate the device and adapt its attack strategy. It can also display fake login screens over legitimate financial applications, specifically targeting banking and cryptocurrency apps. RatHat further poses a threat by intercepting SMS messages and notifications for two-factor authentication codes.

Adding to its danger, RatHat implements persistence mechanisms to thwart removal. It can cancel uninstall processes and use a background service to reinstall itself even after the visible app is deleted. It also seeks Device Admin rights, potentially enabling it to wipe the device if removal is attempted.

Google states that RatHat has not been found on Google Play, and Android devices are protected by Google Play Protect. However, users are advised to install apps only through Google Play, be cautious with Accessibility permissions, keep Wireless Debugging off, and maintain updated antivirus software and operating systems.