Image: Malwarebytes Labs
Android users who install apps from links in texts, ads or unofficial download pages are at risk from RatHat, a Trojan designed to steal financial credentials and device PINs. The attack still depends heavily on persuading the victim to sideload an app and grant powerful accessibility access.
What RatHat can steal
Malwarebytes Labs, citing analysis by Zimperium’s zLabs, reports that RatHat lets a live AI service inspect Android’s accessibility tree—the structured view of buttons, fields and other screen elements—and decide where to tap or scroll. This makes its behavior less predictable than a fixed script.The Trojan places fake screens over targeted apps, mainly financial services, to capture login details, one-time passwords and multi-factor authentication codes. It can also record touch locations and compare them with known keypad or pattern layouts to reconstruct PINs and unlock patterns.
- It can intercept SMS messages and gain semi-autonomous control through its AI service.
- A hidden background component may restore the malicious app after normal removal.
How phones become infected
Victims encounter fake download pages through smishing—phishing sent by SMS—or malicious ads. The pages may impersonate a streaming service or Chrome and instruct the user to sideload an APK, Android’s app installation package.After installation, RatHat uses false network warnings or financial incentives to request Android Accessibility Service access. With that permission, it can inspect screen content and interact with apps for the user.
The malware can then enable Wireless Debugging, read the displayed six-digit pairing code and pair with the same phone. This abuses Android Debug Bridge, a legitimate developer feature, to gain stronger command access outside the app’s normal sandbox.
Steps that block the attack
- Install apps through Google Play or another trusted official store instead of APK links received by text or shown in ads.
- Reject accessibility requests that do not match an app’s genuine purpose, especially requests justified by a supposed network problem or reward.
- Keep Developer Options and Wireless Debugging disabled unless you understand exactly why they are needed.
- If RatHat is confirmed on the device, back up essential personal data carefully and perform a factory reset; ordinary app removal may not remove its persistence mechanism.
