RatHat Android Trojan Uses Generative AI to Navigate Devices

New Android malware combines AI navigation with traditional attack vectors

A sophisticated Android trojan discovered by mobile security firm Zimperium demonstrates how threat actors are integrating generative AI into malware operations. The malware, named RatHat, uses an AI assistant to interpret and navigate device interfaces automatically—a capability that sets it apart from conventional mobile threats.

Zimperium researchers first reported the threat, noting that RatHat spreads through SMS phishing campaigns and malicious advertising. The malware employs a multi-stage infection process designed to escape Android's application sandbox and achieve shell-level execution on compromised devices.

How the AI integration works

RatHat's most distinctive feature is its communication with a generative AI system. The malware serializes the device's live Accessibility tree into XML format, which the AI assistant then reads to understand on-screen content and layout. This allows the malware to automatically navigate and interact with the device interface in real time.

Analysis of the AI prompts embedded in the malware suggests development by a Chinese-speaking threat actor, according to Zimperium's findings.

Multi-component architecture

The malware operates through three interconnected components. A malicious Android application serves as the user-facing layer, gaining critical system permissions and bootstrapping the infection chain. This application uses localized HTML lures to obtain Accessibility Services access and contains a WebView overlay injection engine that displays fake interfaces mimicking popular banking and payment applications.

A second component written in Go functions as the command-and-control brain after the malware gains shell access via the local Android Debug Bridge daemon. This agent executes commands and establishes system-level persistence while securing power management exemptions.

The third component is a reverse-proxy client derived from the fatedier/frp project. It creates a secure, persistent tunnel that gives attackers direct access to the ADB daemon for remote command execution.

Advanced persistence and monitoring

RatHat implements multiple layers of persistence that make removal difficult. The malware can intercept and cancel uninstallation attempts. Even when users successfully remove the application, a hidden shell service remains active on the device, periodically checking for the application's presence and reinstalling it when necessary.

The malware captures user credentials through three specialized keylogging mechanisms. It monitors accessibility text-change events to reconstruct typed input, reads browser address bars by resource ID, and most notably, the Go agent records at the hardware level where users touch the screen. This hardware-level monitoring abuses the standard Android debugging tool getevent to read raw kernel device files, extracting touch coordinates and comparing them against keypad layouts to reconstruct PINs, passwords, and unlock patterns.

Why it matters

RatHat represents a significant evolution in mobile malware sophistication. The integration of generative AI for automated device navigation suggests threat actors are finding practical applications for AI beyond content generation and social engineering. For enterprise security teams, this development underscores the need for mobile threat defense solutions that can detect behavioral anomalies and unauthorized accessibility service usage. The malware's multi-layered persistence mechanisms also highlight gaps in Android's security model when users grant accessibility permissions to malicious applications.

Details of the RatHat trojan were first reported by Zimperium's mobile security research team.