**RatHat** is a newly identified Android malware family that distinguishes itself through its use of an AI-powered subsystem. This advanced capability allows operators to remotely navigate infected devices with greater adaptability and stealth than traditional methods. ### Origins and Distribution **Zimperium zLabs** researchers, who analyzed the malware, suggest a link to Chinese threat actors, citing the presence of Large Language Model (LLM) prompts written in Chinese. **RatHat** is primarily distributed through malvertising, SMS phishing, and malicious websites promoting APK downloads outside of the official **Google Play Store**. ### Exploiting Android Permissions Like many Android malware families, **RatHat** heavily abuses Android's Accessibility permissions. This enables it to perform highly privileged actions on compromised devices. A key feature is its ability to enable Developer Options and Wireless Debugging, establishing a local shell-level execution context without requiring a physical connection. This mechanism has been observed in other Android malware, such as **ToxicPanda** and **RedHook**. ### Persistent Agents and Data Theft Leveraging ADB access, **RatHat** installs a Go-based agent (**liblocal-service.so**) that executes commands with ADB shell privileges, bypasses battery restrictions, and ensures persistence. This agent also acts as a fail-safe, restoring the main malware if it's removed, and vice-versa.  A second agent (**libmedia_codec.so**) functions as an FRP reverse-proxy client, maintaining a persistent tunnel to the attacker. The malware employs HTML overlays to target banking and cryptocurrency applications, stealing credentials. It can also intercept SMS messages and notifications (including one-time passwords), record text-change events, extract URLs from browser address bars, and capture lock-screen PINs, passwords, and unlock patterns.  ### AI-Guided Navigation A standout feature of **RatHat** is its AI-powered user interface automation engine. This engine serializes the live Android Accessibility tree into XML and sends it to an unnamed popular AI assistant. The AI then performs critical tasks: * Identifying the center coordinates of specific interface elements. * Determining on-screen text of elements. * Returning navigation instructions, such as 'SCROLL_DOWN'. This AI integration makes **RatHat**'s interface automation highly adaptable, eliminating the need for operators to perform real-time interactions and making it significantly harder to detect compared to traditional, script-based automation.  ### Evasion and Anti-Analysis Techniques **RatHat** is designed to actively resist removal attempts. It intercepts uninstall confirmation screens, cancels the procedure, and displays a bogus **Google Play** overlay with a fake error message. The malware also incorporates multiple anti-analysis techniques, including APK container tampering, an unusually large (61MB) Android manifest file, and invalid DEX pseudo instructions, all aimed at thwarting security researchers and analysis tools. ### Recommendations for Users and Professionals To mitigate the risk of **RatHat** infection, Android users should strictly avoid downloading APK files from untrusted sources outside the **Google Play Store**. Granting Accessibility permissions to unknown or suspicious applications should be avoided, and devices should be regularly scanned with **Google Play Protect** or other reputable security solutions.