Loading story…
Researchers documented RatHat, an Android banking trojan and remote-access tool tentatively linked to China-based operators. Distributed through smishing, malvertising, deceptive download sites, third-party forums, and trojanized APKs, it abuses Android Accessibility services to enable Wireless Debugging, pair with the device-local ADB daemon, and obtain shell-level execution. RatHat deploys external Go-based daemons and an FRP reverse-proxy client, creating persistence that can survive APK removal and maintaining remote access through NAT and firewall restrictions.
The malware targets banking credentials and authentication data through fraudulent payment overlays, Accessibility-driven text capture, SMS and notification interception for OTP theft, screen capture, and raw /dev/input touch-event collection that can reconstruct PINs and unlock patterns. It also supports AI-assisted UI automation and uses HTTP, WebSocket, and persistent FRP tunnels for command-and-control. Defenses against analysis include malformed APK and manifest structures, DEX poisoning, encrypted strings, and checks for debuggers, Frida, Xposed, rooted devices, and emulators.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Zimperium zLabs published a technical analysis of RatHat, a newly documented Android banking trojan and remote-access malware. The researchers linked it, with moderate confidence, to operators appearing to be based in China and detailed its AI-assisted automation, Wireless ADB abuse, persistence, and credential-theft capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **RedHook** Android banking trojan has resurfaced with upgraded remote-access capabilities that abuse Android **Wireless Debugging** and **Accessibility** features to gain shell-level privileges without rooting the device or exploiting a kernel flaw. Group-IB reported that the malware is being spread through social-engineering lures in which attackers impersonate government officials or bank support staff and direct victims to fake Google Play-style, government, or financial websites hosting malicious APKs, including on services such as **AWS S3** and **GitHub**. Recent activity shows the campaign expanding beyond Vietnam into **Indonesia**. After installation, RedHook tricks victims into enabling Accessibility Service, then automates **Developer Options** and Wireless Debugging, pairs itself over the loopback interface, and launches a privileged helper process running as `uid 2000`, reportedly using code derived from the **Shizuku** framework. In this mode, the malware can silently install apps, change secure settings, capture touch input, steal data, and stream screens or video, including screen capture that bypasses the normal **MediaProjection** consent prompt. Researchers said RedHook maintains persistence through watchdog services, cross-process resurrection, periodic alarms, reboot persistence, wake locks, silent audio playback, and a one-pixel activity, while its WebSocket-based command-and-control infrastructure supports **53 commands**.
Jul 15, 2026
RatOn is a new Android banking trojan targeting Czech and Slovakian users, featuring multi-stage infection, NFC relay attacks, and automated transfer systems. It abuses Accessibility and Device Admin privileges to persist, perform overlay attacks, and automate fraudulent transactions in banking and cryptocurrency apps. The malware is distributed via adult-themed domains and integrates with the NFSkate tool for contactless payment fraud.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026