A newly discovered Android trojan relies on generative AI to more intelligently navigate and control the infected devices, mobile security company Zimperium reports.
Dubbed RatHat, the malware has been distributed through smishing and malvertising, relying on an automated multi-stage infection pipeline to break out of Android’s application sandbox and gain shell-level execution.
RatHat contains typical mobile malware capabilities: it steals users’ credentials, mimics banking and payment applications to steal credentials and access codes, and establishes a covert communication channel with the command-and-control (C&C) server for remote access.
Unlike other mobile threats, however, it also uses generative AI to navigate and control the device’s interface in real time, and monitors users’ input at the hardware level to reconstruct PIN codes, passwords, and patterns. It also grants itself administrator-level permissions to access system functions, and installs a separate hidden background service to reinstall itself and restore its permissions.
The AI prompts used by the malware suggest it was developed by a Chinese threat actor.
RatHat, Zimperium says, is installed through a dropper that carries two encrypted assets, abusing native SessionInstaller APIs to bypass restrictions. Its architecture consists of three parts: a malicious Android application, a Go agent, and an FRP client.
The application gains critical system permissions, bootstraps the infection chain, and provides an interface with the user. It contains a dynamic configuration that allows its operators to enable different activity aliases.
It also uses a localized HTML lure to gain access to the Accessibility Services and elevate its privileges. It contains an advanced WebView overlay injection engine to serve fake interfaces of popular apps, captures the device’s screen and user input, intercepts SMS messages, and requests Device Admin rights, which allow it to wipe the device.