RatHat Android Trojan Turns to GenAI

Security researchers at Zimperium have discovered a new Android malware strain targeting credential and bank detail harvesting. The malware, named RatHat by the researchers, is linked to threat actors that appear to be operating in China, according to the firm's zLabs team. It incorporates novel techniques for persistence and leverages generative AI for operational control.

Delivery via Phishing and Malvertising

RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums. The threat actors behind the malicious campaign use these channels to lure victims into manually downloading malicious Android package kits (APKs) that appear to be legitimate apps.

Once deployed, the malicious app deploys RatHat via a dropper that carries the payload in two encrypted assets. The dropper exploits native SessionInstaller APIs to bypass Android's restricted settings and Accessibility Service protections, enabling the installation of the malicious payload and subsequent access to protected APIs. The malware also contains four anti-analysis layers and one anti-debug layer to bypass Android's security controls.

Three-Part Architecture

The architecture of the RatHat malware can be broken down into three primary operational parts: a malicious Android application, a Go agent (liblocal-service.so), and an FRP client (libmedia_codec.so).

The app's main role is to act as the primary interface with the user, acquire critical system permissions and bootstrap the rest of the infection chain. The app carries spyware capabilities, with the capacity to collect banking credentials, notifications, two-factor authentication (2FA) and one-time-password (OTP) keys, and capture screen and inputs.

In a malware analysis published on September 16, Zimperium's zLabs team noted a particularly interesting feature in the malicious app: a generative AI user interface-automation engine.

A GenAI Interface-Automation Engine

In practice, RatHat serializes the target device's live Accessibility tree to XML and communicates in Mandarin with “one of the world’s most popular generative AI assistants,” the researchers noted. This AI tool is used for non-malicious actions including resolving a named target's centre coordinates on the screen as JSON to direct synthetic clicks, resolving a target's actual on-screen text from the XML (without translating), and signaling automatic navigation commands like SCROLL_DOWN.

While the researchers did not specify which AI tool is used in the report, they provided a graph suggesting the threat actors used Google's Gemini AI models. The prompts used by RatHat operators in the zLabs investigation are the main indicator of potential China-based threat actors.

Go Agent and FRP Client

The Go agent is the privileged command-and-control (C2) executor that runs commands through the local ADB shell context to bypass app-level security restrictions. It handles critical system-level tasks like exempting the app from battery optimization/Doze mode, prioritizing its background execution and disabling or uninstalling other packages (like security apps), while also fetching the FRP client's configuration from the C2 server.

Finally, the FRP client establishes a persistent, secure reverse tunnel from the infected device back to the attacker's C2 server. Its sole purpose is to give attackers ongoing remote access to the device's ADB daemon, acting as a general-purpose backdoor that can carry arbitrary commands independent of the malware's built-in features.

Why Signature-Based Defenses Fall Short

“RatHat’s multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient,” the zLabs report noted.

— Zimperium zLabs team, in a malware analysis published on September 16

The zLabs analysis emphasizes that the combination of a multi-tiered architecture, out-of-lifecycle daemons and real-time GenAI decision loops poses challenges for traditional, signature-based mobile security controls.

Key Facts at a Glance

• Malware name: RatHat
• Discovered by: Zimperium's zLabs team
• Analysis published: September 16
• Anti-analysis layers: four
• Anti-debug layers: one
• Primary operational parts: three (malicious Android application, Go agent, FRP client)
• Linked to threat actors appearing to operate in China
• Distribution methods: malvertising, smishing, third-party forums

What This Means for Android Users and Businesses

The reliance on generative AI to automate UI interactions suggests that attackers are finding ways to make malware more adaptive to different device layouts and user behaviors. This could make it harder for signature-based tools to detect malicious activity, as the malware may not follow a fixed pattern.

For businesses, the use of smishing and malvertising to distribute malicious APKs highlights the need to educate employees about the risks of sideloading apps and clicking on links in unsolicited messages. Organizations should also consider implementing mobile threat defense solutions that can detect anomalous behavior, such as apps requesting accessibility services or attempting to bypass restricted settings.

Consumers should be cautious when downloading apps from third-party sources and should verify the legitimacy of any app before installation. Enabling Google Play Protect and keeping devices updated can help mitigate some risks, though the malware's anti-analysis techniques may evade some protections.

The integration of generative AI into malware represents a shift in how threat actors may operate, potentially lowering the barrier for creating sophisticated attacks. As AI tools become more accessible, defenders may need to adopt AI-powered defenses to keep pace.