The malware is reported to be distributed through malicious advertising, SMS messages and phishing websites that promote APK downloads outside Google Play.
RatHat takes advantage of Android’s Accessibility permissions to obtain extensive control over infected devices. This allows it to enable Developer Options and Wireless Debugging, granting it a local shell-level execution environment without the need for a separate computer. Researchers observed similarities with this technique that have been previously seen in the ToxicPanda and RedHook Android malware families.
The malware utilizes Android Debug Bridge (ADB) access to install a Go-based agent called liblocal-service.so. The agent can execute commands with ADB shell privileges, bypassing battery restrictions and establishing persistence. It can also restore the malware in the case that the main component is removed or stopped. The relationship works in both directions, with the malware being able to restore the agent if the agent itself is deleted.
RatHat also makes use of a second component, libmedia_codec.so, which acts as an FRP reverse-proxy client and establishes a persistent tunnel to the attackers. The malware has the ability to display HTML overlays over targeted banking and cryptocurrency applications in order to acquire the users’ credentials.
Its information-stealing capabilities include SMS messages and notifications, including one-time passwords. RatHat can also monitor text changes, extract URLs from browser address bars and capture lock-screen PINs, passwords and unlock patterns.
One of RatHat’s most interesting features is its AI-powered interface automation engine. According to Zimperium, the malware converts the Android Accessibility tree into XML and sends the resulting information to an unnamed popular AI assistant. This system can recognize the screen coordinates of requested interface elements and determine their displayed text and provide navigation commands such as scrolling instructions.
This enables the malware to navigate Android interfaces more dynamically than other malware that exclusively rely on predetermined scripts.
Zimperium stated that the AI-driven system makes the malware more adaptable and arguably harder for security software to detect.
RatHat actively prevents victims from uninstalling the malware. When an uninstall confirmation screen appears, the malware can intercept the process and cancel the removal and display a fake Google Play overlay, which shows a fraudulent error message.
The malware also contains a number of anti-analysis measures, including APK container manipulation, an unusually large 61MB Android manifest and invalid DEX pseudo-instructions that are designed to confuse or disrupt the functionality of security analysis tools.
Android users are advised to avoid downloading APK files from outside Google Play unless the publisher is explicitly trusted and to be careful when granting Accessibility permissions to applications. In addition, users should regularly scan their devices using Google Play Protect.
