- Researchers have uncovered a new Android malware called RatHat, linked to China-based threat actors, which uses AI to navigate compromised devices.
- RatHat spreads through targeted smishing and malvertising campaigns and employs a multi-stage infection pipeline that breaks out of Android’s sandbox.
- The malware abuses accessibility services to enable wireless debugging, extract ADB pairing codes, and deploy Go-based agents for persistent shell access.
Cybersecurity researchers have flagged a new Android malware called RatHat, assessed to be operated by China-based threat actors, that features an artificial intelligence-powered system to navigate and control compromised devices. Distributed primarily via targeted smishing and malvertising campaigns leading to deceptive third-party download portals, RatHat uses an automated multi-stage infection pipeline, according to Zimperium researchers.
Once deployed, the malware pairs Accessibility abuse with autonomous local ADB self-pairing to break out of the standard Android application sandbox. The malicious APK functions as a dropper, incorporating four anti-analysis techniques: container tampering using ZIP encryption flags, a manifest bomb that crashes automated pipelines, DEX bytecode poisoning with invalid element attributes, and dual string-encryption via Base64.
RatHat’s architecture consists of a malicious Android app, a Go agent, and an FRP reverse-proxy client. The Android app acquires accessibility services permissions, then abuses them to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code. The malware serves overlays atop specific apps to harvest credentials, records the screen using MediaProjection API, intercepts SMS messages, and overrides installation attempts with a fake Google Play Store overlay.
Even if the victim uninstalls the app, the attacker retains shell access via a local ADB daemon. The Go Agent masquerades as a native library to execute commands, establish persistence, and apply power management exemptions. The FRP client creates a secure reverse tunnel to the C2 server, allowing attackers to collect SMS, credentials, files, lock screen PIN, screen captures, keystrokes, and installed apps—including a hardware-level keylogger that records finger presses. Zimperium noted that RatHat’s multi-tiered architecture and reliance on out-of-lifecycle daemons illustrate why traditional, signature-based mobile security controls are insufficient.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
