Cybersecurity researchers at **Zimperium** have issued a warning regarding **RatHat**, an advanced Android malware exhibiting capabilities previously unseen in mobile threats. This new menace is believed to be orchestrated by China-based threat actors and notably integrates an AI-powered system to autonomously navigate and control compromised devices. According to **Zimperium** researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega, **RatHat** is primarily disseminated through targeted smishing (SMS/text phishing) and malvertising campaigns. These campaigns direct unsuspecting users to deceptive third-party download portals, initiating an automated, multi-stage infection process. Once deployed, **RatHat** leverages accessibility abuse in conjunction with autonomous local **ADB** (Android Debug Bridge) self-pairing. This allows it to bypass the standard Android application sandbox, staging independent native daemons that execute with shell-level privileges. The propagation of **RatHat** relies on phishing sites promoted via malvertising, smishing, and third-party forums. These tactics trick users into installing malicious APKs that act as droppers for the main payload. The malware incorporates multiple layers of anti-analysis and anti-debug checks to evade detection. ### Evasive Anti-Analysis Techniques **RatHat** employs four sophisticated anti-analysis techniques: * **Container tampering**: Declares certain files as directories within the package or sets the ZIP general-purpose encryption bit flag on some files. This causes them to be ignored by Android's `libziparchive` library but not by other tools like `unzip` and `apktool`. * **Manifest bomb**: Inserts undocumented `0x9999` chunk headers into `AndroidManifest.xml`, causing automated analysis pipelines to crash or time out, as these are skipped by the Android native runtime. * **DEX bytecode poisoning**: Includes pseudo-instructions with an invalid `element_width` attribute, designed to cause the disassembly process to fail. * **Dual string-encryption**: Utilizes a robust encryption scheme called StringCrypto: Base64 to resist analysis efforts. ### Multi-Component Architecture The Android malware's architecture comprises three core components: the malicious Android application, a **Go Agent**, and an **FRP** reverse-proxy client. The Android app's initial role is to acquire critical system permissions and initiate subsequent attack phases. It obtains accessibility services permissions, which it then abuses to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit **ADB** pairing code.  The malware is designed to serve overlays atop specific applications to harvest credentials, record the screen using Android's MediaProjection API, intercept SMS messages, and even override uninstallation attempts by displaying a fake failure overlay impersonating the **Google Play Store**. Critically, even if a victim manages to uninstall the malicious application, the attacker retains shell access to the device. The local service can be weaponized to check for the malware's presence and re-install it if it's not found, ensuring persistence. ### AI-Powered Navigation and Control One of **RatHat**'s most alarming features is its integration with a Generative AI assistant. **Zimperium** notes that the malware serializes the device's live Accessibility tree to XML and communicates with one of the world's most popular GenAI assistants. This AI is utilized for non-malicious actions, including: * Resolving a named target's center coordinates on the screen as JSON to direct synthetic clicks. * Resolving a target's actual on-screen text from the XML. * Signaling automatic navigation commands like `SCROLL_DOWN`. The **Go Agent**, executed by the APK, masquerades as a native library (`liblocal-service.so`). It leverages the shell access gained via the local **ADB** daemon to execute commands, establishing persistence and applying power management exemptions. The **FRP** client (**frp** is a fast reverse proxy open-source project) is instrumental in establishing a secure, reverse tunnel to a command-and-control (C2) server. This connection is vital for maintaining covert communication. "The **Go Agent** retrieves the **FRP** tunnel configuration from the C2 server, enabling the **FRP** Client to establish a persistent, active reverse tunnel to the operator," the researchers stated. "This connection is used by attackers to have access to the **ADB** daemon: it's a general-purpose road into the device that carries whatever the operator wants, independent of the malware's own feature set." Commands issued by the C2 server are extensive, enabling threat actors to collect SMS messages, credentials, files, lock screen PINs, patterns, or passwords, screen captures, keystrokes (including URLs entered in web browser address bars), and a list of installed applications. **RatHat** also includes a hardware-level keylogger, executed by the **Go Agent**, capable of recording finger presses on the screen. **Zimperium** concludes that "**RatHat**'s multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient," emphasizing the evolving threat landscape for mobile security.