remote-access-implantcybercrime-service-ecosystemai-enabled-threat-activitypersistence-method

RatHat Android Banking Trojan Uses Gemini to Rank and Control Victims

Malware Intelligence · 5 sources · Updated 1mo ago · First seen Sep 28, 2026

Researchers at Cleafy identified nearly 100 deployments of the RatHat Android banking trojan between April and September 2026, finding a rapidly evolving malware-as-a-service platform behind an implant that has otherwise changed little since late 2025. Its command-and-control panels progressed from Fisher to BlackCat Remote Control Management and Panda Workshop V5/V6, enabling operators to build, sign, host, regenerate, and administer malicious Android applications. Victims are lured through SMS messages and online advertisements to third-party download sites.

RatHat abuses Android Accessibility services to activate wireless ADB debugging and gain a UID 2000 shell, allowing remote screen monitoring and input control. Operators can deploy a native Go component that persists after the malicious app is removed, retaining shell-level access until the device restarts. Panda Workshop V6 uses Google Gemini to estimate and rank victims by bank balance using harvested SMS data, while the implant can invoke an LLM to identify where to tap in unfamiliar device interfaces when conventional automation fails.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 2025 – Sep 28, 2026

Sep 28, 20262mo ago
Cleafy publishes RatHat malware-as-a-service research
Cleafy published research documenting nearly 100 RatHat console deployments since April 2026 and an evolution from Fisher to BlackCat and Panda Workshop panels. The research described MaaS-style customer-operated consoles, Gemini-assisted victim ranking and navigation, and wireless-debugging abuse that can deploy a persistent Go service with shell-level control.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Sep 2026
Panda Workshop V6 C2 infrastructure is identified
Cleafy identified admin.chunhuating[.]best as a Panda Workshop V6 C2 domain. The V6 panel included fraudulent download-page templates and used Google Gemini to assess harvested SMS data for estimated victim bank balances and prioritization.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Aug 2026
Panda Workshop V5 C2 deployment is identified
Cleafy identified admin.xiongmaocs[.]pics as a Panda Workshop V5 C2 domain. This panel generation added two-factor authentication for C2 operators.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Apr 2026
BlackCat RatHat C2 infrastructure appears
Cleafy identified 8.231.120[.]246 as a BlackCat control-server address in April 2026. RatHat console deployments began appearing from April onward, marking the shift away from the earlier Fisher infrastructure.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Dec 2025
RatHat communicates with the Fisher control console
RatHat samples from late 2025 and February 2026 communicated with the earlier Fisher console. Cleafy identified admin.rathat[.]live as a Fisher C2 domain used in December 2025 and February 2026.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

RatHat

Observables

11 linked

Domain••••••.comMD5 hash••••••••••••••••••••••••••••••••URLhttps://•••••••.•••/••••••IPv4 address•••.•••.••.•••Domain••••••••••.comMD5 hash••••••••••••••••••••••••••••••••URLhttps://•••••.•••/••••••Domain••••••.ru+3

Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Sep 30, 2026

RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App PermissionsOpen source ↗

Cryptika BlogNews · Sep 30, 2026

RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions | Cryptika CybersecurityOpen source ↗

Infosecurity Magazine NewsNews · Sep 29, 2026

RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model - Infosecurity MagazineOpen source ↗

The Hacker NewsNews · Sep 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value VictimsOpen source ↗

Cleafy LabsNews · Sep 28, 2026

From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | CleafyOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

remote-access-implantcybercrime-service-ecosystemai-enabled-threat-activitypersistence-method

RatHat Android Banking Trojan Uses Gemini to Rank and Control Victims

Malware Intelligence · 5 sources · Updated 1mo ago · First seen Sep 28, 2026

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 2025 – Sep 28, 2026

Sep 28, 20262mo ago
Cleafy publishes RatHat malware-as-a-service research
Cleafy published research documenting nearly 100 RatHat console deployments since April 2026 and an evolution from Fisher to BlackCat and Panda Workshop panels. The research described MaaS-style customer-operated consoles, Gemini-assisted victim ranking and navigation, and wireless-debugging abuse that can deploy a persistent Go service with shell-level control.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Sep 2026
Panda Workshop V6 C2 infrastructure is identified
Cleafy identified admin.chunhuating[.]best as a Panda Workshop V6 C2 domain. The V6 panel included fraudulent download-page templates and used Google Gemini to assess harvested SMS data for estimated victim bank balances and prioritization.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Aug 2026
Panda Workshop V5 C2 deployment is identified
Cleafy identified admin.xiongmaocs[.]pics as a Panda Workshop V5 C2 domain. This panel generation added two-factor authentication for C2 operators.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Apr 2026
BlackCat RatHat C2 infrastructure appears
Cleafy identified 8.231.120[.]246 as a BlackCat control-server address in April 2026. RatHat console deployments began appearing from April onward, marking the shift away from the earlier Fisher infrastructure.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Dec 2025
RatHat communicates with the Fisher control console
RatHat samples from late 2025 and February 2026 communicated with the earlier Fisher console. Cleafy identified admin.rathat[.]live as a Fisher C2 domain used in December 2025 and February 2026.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

RatHat

Observables

11 linked

Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Sep 30, 2026

RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App PermissionsOpen source ↗

Cryptika BlogNews · Sep 30, 2026

RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions | Cryptika CybersecurityOpen source ↗

Infosecurity Magazine NewsNews · Sep 29, 2026

RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model - Infosecurity MagazineOpen source ↗

The Hacker NewsNews · Sep 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value VictimsOpen source ↗

Cleafy LabsNews · Sep 28, 2026

From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | CleafyOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

RatHat Android Banking Trojan Uses Gemini to Rank and Control Victims

How this story unfolded

Cleafy publishes RatHat malware-as-a-service research

Panda Workshop V6 C2 infrastructure is identified

Panda Workshop V5 C2 deployment is identified

BlackCat RatHat C2 infrastructure appears

RatHat communicates with the Fisher control console

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

RatHat Android Trojan Uses Wireless ADB to Steal Banking Credentials

Four Android Banking Trojans Target 800+ Apps With MFA-Bypassing Overlays

RatOn Android Banking Trojan Emerges with NFC Relay and Automated Transfer Capabilities

RatHat Android Banking Trojan Uses Gemini to Rank and Control Victims

How this story unfolded

Cleafy publishes RatHat malware-as-a-service research

Panda Workshop V6 C2 infrastructure is identified

Panda Workshop V5 C2 deployment is identified

BlackCat RatHat C2 infrastructure appears

RatHat communicates with the Fisher control console

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

RatHat Android Trojan Uses Wireless ADB to Steal Banking Credentials

Four Android Banking Trojans Target 800+ Apps With MFA-Bypassing Overlays

RatOn Android Banking Trojan Emerges with NFC Relay and Automated Transfer Capabilities