Loading malware…
RatHat is an Android banking trojan combining credential theft, surveillance, and remote device control. It is distributed through smishing, malicious advertisements, and deceptive download pages, including pages impersonating Google Play, that persuade victims to sideload malicious applications. Campaigns have targeted users in Europe, Latin America, and Southeast Asia. Its WebView-based HTML overlays impersonate banking, payment, and cryptocurrency applications to capture credentials and authentication codes. RatHat also collects SMS messages, notifications, contacts, photographs, files, and installed-application information.
After obtaining Accessibility access, RatHat automates Android settings interactions to enable Wireless Debugging, read the pairing code, and connect to the device’s local Android Debug Bridge service. This provides execution as Android’s shell user, UID 2000, rather than root. Operators can then deploy an independent Go-based control service and an FRP reverse-proxy client for tunneled remote access. The service supports command execution, screen capture, and touch injection. On supported Android versions, native testing tools enable screen capture and input injection without the usual MediaProjection consent prompt or recording indicator; this approach does not work on Android 14 and later, where RatHat relies on app-based capture requiring consent.
RatHat records Accessibility text-change events and uses shell access to collect raw touchscreen events, allowing touch coordinates to be correlated with keypad layouts to reconstruct PINs, passwords, and unlock patterns. It resists uninstallation, can restore its application and permissions through its independent service, and can remain active after removal of the visible application until reboot. Anti-analysis measures include malformed application structures, oversized manifests, invalid bytecode metadata, string obfuscation, and checks for instrumentation and emulated environments.
RatHat integrates Google Gemini Flash into its wireless-debugging setup workflow. When fixed interface matching fails, the implant submits structured Accessibility-tree information and uses model responses to locate controls on unfamiliar Android interfaces or in different languages. A separate operator-side AI function analyzes stolen SMS messages to estimate bank balances and prioritize victims. These functions support setup automation and victim valuation; AI-driven fraudulent transfers have not been established. Its operator consoles support application building, signing, publishing, credential-overlay management, and scheduled rebuilding intended to evade hash-based detection.
51 distinct techniques documented for this family, organized by ATT&CK tactic.
RatHat is primarily distributed through deceptive phishing sites promoted via malvertising.
The malware is reported to be distributed through malicious advertising, SMS messages and phishing websites that promote APK downloads outside Google Play.
“Attackers distribute it through malicious adverts and phishing text messages” and “V6 ... added phishing download-page templates.”
“The campaign relies on deceptive download pages promoted through text-message phishing, malicious advertising and third-party forums.”
RatHat installs an AI-assisted agent that runs system commands to steal information.
“After gaining a shell via the local ADB daemon, the malware drops and executes an agent written in Go.”
“With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device.”
“RatHat ... is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions.”
“[It relies] on an automated multi-stage infection pipeline to break out of Android’s application sandbox and gain shell-level execution.”
“Fake apps lure victims into granting Accessibility access” and operators can “build, package, sign and publish malicious apps without leaving the console.”
“Once pairing succeeds, an operator can deploy a separate service written in Go with one click. It runs independently of the app...”
The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.
“After receiving Accessibility access, RATHat navigates the phone’s settings, enables wireless debugging and reads the pairing code displayed on screen.”
The local-service is running outside the package lifecycle... if the app is not confirmed, then the app is reinstalled... granting every runtime permission automatically and re-granting Accessibility.
“Once pairing succeeds, an operator can deploy a separate service written in Go with one click. It runs independently of the app...”
The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.
“After receiving Accessibility access, RATHat navigates the phone’s settings, enables wireless debugging and reads the pairing code displayed on screen.”
The local-service is running outside the package lifecycle... if the app is not confirmed, then the app is reinstalled... granting every runtime permission automatically and re-granting Accessibility.
RatHat uses the accessibility permissions users grant it to navigate your phone’s menu system and unlock Wireless Debugging ... then grants itself ADB Shell permissions. This effectively grants the malware admin access to your device.
Once the service is granted, SystemHelperService becomes the engine for every automated system change... Unlock Developer Options... Enable Wireless Debugging... scrape the 6-digit ADB Pairing Code and dynamic port.
The app can request Device Admin rights, which grants it the capability to wipe the device if an uninstall attempt is made.
“V6 obscured its frontend code” and “Scheduled rebuilding produces fresh files while keeping the underlying implant unchanged, helping campaigns evade detection methods that depend on recognizing previously recorded file hashes.”
The container tampering layer consists of declaring some files as directories in the zip, or setting the ZIP general-purpose encryption bit on some files. These modifications are ignored by Android libziparchive but not by unzip, apktool and other tools.
“Fake apps lure victims into granting Accessibility access,” and earlier campaigns used “cryptocurrency trading and adult entertainment decoys.”
“Scheduled rebuilding produces fresh files while keeping the underlying implant unchanged, helping campaigns evade detection methods that depend on recognizing previously recorded file hashes.”
“The Go agent abuses its execution in a shell environment to use the standard Android debugging tool getevent to read the raw device file the kernel writes to.”
The malware also contains four anti-analysis layers and one anti-debug layer to bypass Android’s security controls.
“The removal gap is important: deleting the visible app does not immediately stop the independent service, which survives until reboot.”
“The second stage is a DEX file loaded directly into memory through reflection.”
“Anti-Debugging: Checks for debuggers, Frida, Xposed, root indicators, and emulators.”
RatHat actively prevents victims from uninstalling the malware. When an uninstall confirmation screen appears, the malware can intercept the process and cancel the removal and display a fake Google Play overlay, which shows a fraudulent error message.
“The service can ... inject touches using Android testing tools” and “Fake screens placed over targeted apps capture entered information.”
“The malware implements keylogging through three specialized mechanisms: it monitors accessibility text-change events ... reads browser address bars ... [and] can record, at the hardware level, where the user’s finger touched the screen.”
“Fake screens placed over targeted apps capture entered information.”
“RatHat also uses WebView-based HTML overlays that appear over targeted banking and crypto apps, presenting fake interfaces designed to capture users’ login credentials.”
“Combine that with SMS interception for 2FA codes and you’ve got full account takeover.”
An SMS receiver and notification listener work in tandem to intercept 2FA/OTP codes... /api/data/messages [carries] SMS bodies.
“cert.pem Device ADB certificate collected and uploaded by the malware” and “private.key Device ADB private key collected and uploaded by the malware.”
“[A] second component [is] scraping URLs straight out of browser address bars.”
The malware also contains four anti-analysis layers and one anti-debug layer to bypass Android’s security controls.
“The removal gap is important: deleting the visible app does not immediately stop the independent service, which survives until reboot.”
„Командите што ги испраќа C2 серверот ... овозможувајќи ... да собираат ... листа на инсталирани апликации.“
“Anti-Debugging: Checks for debuggers, Frida, Xposed, root indicators, and emulators.”
“RatHat uses automated taps to enable Developer Options and Wireless Debugging… then pairs with the phone’s local ADB service.”
“With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device.”
“It pairs with the local Android Debug Bridge service, gaining access as the shell user, identified by Android as UID 2000.”
“Alongside remote control, the panel exposes stolen messages, credentials, contacts, photographs and files.”
“The service can ... inject touches using Android testing tools” and “Fake screens placed over targeted apps capture entered information.”
“The malware implements keylogging through three specialized mechanisms: it monitors accessibility text-change events ... reads browser address bars ... [and] can record, at the hardware level, where the user’s finger touched the screen.”
“Fake screens placed over targeted apps capture entered information.”
“RatHat also uses WebView-based HTML overlays that appear over targeted banking and crypto apps, presenting fake interfaces designed to capture users’ login credentials.”
“The service can capture screen content ... using Android testing tools without the usual screen-recording prompt or indicator.”
“[It] intercepts SMS messages.”
C2 commands allow collection of "credentials, files, lock screen PIN, pattern, or password, screen captures, keystrokes ... and a list of installed applications."
“[RatHat] establishes a covert communication channel with the command-and-control (C&C) server for remote access.”
“It runs independently of the app, opens a local HTTP server on port 7912 and remains reachable through a reverse tunnel to the attacker’s infrastructure.”
RatHat installs ... a proxy client that tunnels that stolen information back to the hacker.
“A deploy button starts a separate program written in Go that stays reachable through a reverse tunnel, a connection the phone opens to the operator's server.”
“Once pairing succeeds, an operator can deploy a separate service written in Go with one click” and “Downloaded testing tools retain recognizable filenames in the temporary deployment directory.”
The application authenticates against the local device's ADB daemon, thereby securing shell-level access... staging and launching both the Go Agent and the FRP Client.
“It runs independently of the app, opens a local HTTP server on port 7912 and remains reachable through a reverse tunnel to the attacker’s infrastructure.”
Endpoints carry overlay-harvested credentials, lock-screen credential sync, SMS bodies, installed-application inventory, files, ADB certificates, logs, screen-monitoring data, and chunked video uploads.
“RatHat can intercept and cancel uninstallation attempts.”
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.