A new twist in Android malware has come to light: the RatHat banking trojan’s web-based control console has started using Google’s Gemini AI to pick out higher-value victims. This development marks a leap in malware sophistication and shows how threat actors are now employing generative AI to sharpen their targeting strategy. While the malware still doesn’t move money directly, its evolving capabilities pose fresh challenges for mobile security.
What Is RatHat, and What’s New?
RatHat is a banking trojan built on a malware-as-a-service model. It lets operators deploy Android malware, control compromised devices, extract credentials, overlays to mimic banking login screens, and siphon text messages and passwords. Since April 2026, around 100 separate instances of its console have been documented, each operated by different clients running the same backend infrastructure. These consoles can build and distribute the malware embedded in benign apps—uploading them to platforms like Amazon S3 or other servers—automatically. Frequent rebuilds (even hourly) are used to avoid detection methods that rely on file-hash matching. Fake download pages, including templates mimicking the Google Store, are now integrated.
Earlier versions—codenamed Fisher, BlackCat Remote Control Management, and Panda Workshop V5/V6—date back to late 2025 and early 2026. They differ slightly in name and interface but share the same core malware payload and functionality.
Gemini AI Helps Spot the High-Value Targets
The most recent iteration of RatHat introduces Gemini into its victim-evaluation workflow. After collecting messages and login data, the console asks Gemini to estimate how much money each victim has—then classifies infected devices into “high-value” or “mid-value” groups. The malware also uses Gemini directly on the phone: when built-in instructions for tap-based interactions fail (due to manufacturer skin, Android version, or language differences), the device sends screen layout data to Gemini and receives guidance on where to tap. Operators can also generate alerts via Telegram when a device’s AI score crosses a threshold.
Although Gemini helps prioritize targets, it’s not used to execute financial transactions—so far its role is purely reconnaissance and aid in allocating operator resources.
Gain Shell Access via Accessibility & Wireless Debugging
RatHat achieves deeper control by requesting Android’s Accessibility permission, which lets it read the screen and simulate user interaction. It then enables wireless debugging, reads screen pairing codes, and connects via Android Debug Bridge (ADB). This gives attackers a shell with elevated “shell user” privileges (UID 2000), allowing access beyond what the app’s usual permissions would allow.
From the console dashboard, once the operator clicks a “deploy” button, a separate program (written in Go) is launched on the device via a reverse tunnel. This program enables streaming of the display using tools like minicap and minitouch—comprising a powerful stealthier alternative to on-screen capture with permission prompts. On Android 14 and newer, however, these tools don’t work, so a fallback method (a low-frame-rate screencap tool) is used instead. The program also persists after app removal and can restore the app and Accessibility permissions—even surviving restarts in some cases.
Deployment, Detection, and Indicators
Deployment of RatHat consoles is widespread enough to show trends: about half of detected console IPs are clustered in a Singapore-registered network. The malware gets delivered through text messages and ads that redirect to third-party download sites. The console backend often uses low-cost top-level domains (.best,.beer,.top), with admin- prefixed domains or adminapi endpoints.
Security researchers have published a set of indicators to watch for: specific domain names (e.g. admin.chunhuating.best, admin.xiongmaocs.pics), hosting IPs, URLs leading to malicious APKs, and certain MD5 hashes tied to known samples. Monitoring tools should flag activities running under the Android shell user (UID 2000), presence of minicap/minitouch files in sensitive directories, and unusual network endpoints.
Why This Matters—and What to Watch
RatHat’s evolution represents a broader shift: AI isn’t just generating content or powering chatbots—it’s now embedded in active malware campaigns, driving decision-making in real time. The move to use Gemini to triage victims shows attackers are optimizing their efforts, choosing when to invest resources to break into more lucrative targets. The use of Accessibility and ADB vulnerabilities underscores weaknesses still present in Android’s permission architecture.
Looking ahead, defenders should focus on detecting misuse of ADB, tracking unexpected shell user activity, and flagging apps that request both Accessibility permissions and wireless debugging. AI model integration in malware will likely increase, making anomaly detection and behavioral analysis more critical than signature-based methods. The other key risk: what happens if the malware evolves next to automate financial operations, not just reconnaissance. In short: this episode warns us that AI is becoming another tool in attackers’ arsenals—not just for sophistication, but for scaling damage.
