Our takeZimperium reports RatHat Android malware uses an AI subsystem to automate device control and steal financial data. A skilled human could already do this — the gain is speed and scale, not a novel capability. Treat devices as untrusted if they hold banking apps.Cyber Resilience desk
Sources (3)
- securityweek · securityweek
- hackread · hackread
- hackernews · hackernews
What this means for you — Security leader:RatHat is an Android banking trojan that uses generative AI for real-time device navigation, credential theft, OTP interception, and persistence. Mobile device management and strict app allow-listing remain the primary controls; treat any sideloaded or unknown banking app as untrusted.
What this means for you — Lean IT orgs:If staff use Android phones or tablets for banking or work apps, assume they can be silently controlled by this malware. Only install apps from the official Play Store, enable Google Play Protect, and avoid sideloading.
What this means for you — MSP:RatHat uses AI to navigate infected Android devices, steal banking credentials, capture OTPs, and reinstall after removal. Scan managed mobile fleets for anomalous accessibility-service usage and suspicious banking-related packages across client environments.
What this means for you — Researcher:RatHat Android trojan employs generative AI for device control, banking credential theft, OTP interception, and self-reinstallation. Corroborated reports from SecurityWeek and HackRead; treat as active threat to Android banking users.