CyberNew CyberNew
Ransomware & Malware BleepingComputer 4 weeks ago

New RatHat Android malware uses AI to automate device control

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese. The researchers say the malware is distributed through malvertising, SMS, and..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Android

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese.

The researchers say the malware is distributed through malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play.

Like most Android malware families, RatHat relies on abusing Android's Accessibility permissions to perform highly privileged actions on infected devices.

Most notably, it enables Developer Options and Wireless Debugging to gain a local shell-level execution context without requiring an external computer, similarly to mechanisms seen in the ToxicPanda and RedHook Android malware families.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →