RatHat Android Malware Uses AI to Control Infected Devices

Cybersecurity researchers have uncovered a new Android malware called RatHat, which is believed to be operated by China-based threat actors and uses an artificial intelligence (AI)-powered system to navigate and control compromised devices.

According to researchers at Zimperium, RatHat is primarily distributed through targeted smishing campaigns and malvertising. Victims are directed to deceptive third-party download websites where they are tricked into installing malicious Android APK files.

Once installed, RatHat uses a multi-stage infection process that abuses Android Accessibility Services and Android Debug Bridge (ADB) capabilities to gain deeper control over the infected device.

The malware's architecture consists of three major components: a malicious Android application, a Go-based agent, and an FRP reverse-proxy client.

The Android application initially attempts to obtain sensitive permissions, including Accessibility Services. It then abuses these permissions to unlock Developer Options, enable Wireless Debugging, and extract the six-digit ADB pairing code.

Advanced Anti-Analysis Techniques

RatHat incorporates multiple techniques designed to make analysis and detection more difficult.

These include:

  • Container tampering: Manipulating APK archive structures so certain analysis tools handle files differently from the Android runtime.
  • Manifest bomb: Adding unusual data structures to AndroidManifest.xml that can cause automated analysis systems to crash or time out.
  • DEX bytecode poisoning: Including malformed pseudo-instructions that can interfere with disassembly.
  • Dual string encryption: Using encryption and Base64 encoding to make important strings harder to analyze.

RatHat Capabilities

Once it gains access to the device, RatHat can perform a wide range of malicious activities.

Researchers found that the malware can:

  • Display overlays on targeted applications to steal credentials.
  • Record the device screen using Android's MediaProjection API.
  • Intercept SMS messages.
  • Capture keystrokes.
  • Collect URLs entered into browser address bars.
  • Collect installed application information.
  • Capture files from the device.
  • Obtain lock-screen PINs, patterns, or passwords.
  • Perform screen captures.
  • Monitor user interactions.
  • Record finger presses using a hardware-level keylogger.

The malware can also display fake installation failure messages that imitate the Google Play Store, potentially preventing victims from realizing that malicious activity is taking place.

Persistence Through Local ADB Access

One of the more concerning aspects of RatHat is that removing the malicious application may not completely eliminate the attacker's access.

The malware establishes a local ADB service that provides shell-level access to the device. According to Zimperium, attackers can use this access to check whether the malware remains installed and potentially reinstall it if the application has been removed.

The Go Agent, which masquerades as a native library named liblocal-service.so, uses the acquired shell access to execute commands and establish persistence.

RatHat also uses an FRP reverse-proxy client to create a persistent reverse tunnel between the compromised device and the attacker's infrastructure.

This tunnel provides attackers with access to the device's ADB daemon and can potentially act as a general-purpose channel for remote operations.

AI-Powered Device Navigation

A notable feature of RatHat is its use of generative AI to help automate interaction with the infected Android device.

The malware can serialize the device's Accessibility tree into XML and send information to a generative AI assistant.

According to Zimperium, the AI system can assist with tasks such as:

  • Identifying the screen coordinates of a specific target.
  • Determining the visible text associated with an interface element.
  • Generating navigation instructions such as scrolling down.

This allows the malware to automate interaction with applications based on what is currently displayed on the victim's screen.

The researchers said this capability demonstrates how AI can potentially be integrated into malware to make automated interaction with mobile applications more flexible.

Command-and-Control Infrastructure

RatHat communicates with attacker-controlled infrastructure through its FRP-based reverse tunnel.

The Go Agent retrieves the FRP tunnel configuration from the command-and-control (C2) infrastructure. The FRP client then establishes a persistent connection that allows the attacker to reach the device's ADB daemon.

Through this channel, attackers can issue commands and collect information from compromised devices.

Distribution Through Phishing and Malvertising

RatHat is primarily distributed through deceptive websites promoted through:

  • SMS phishing campaigns
  • Malvertising
  • Third-party forums
  • Fake APK download portals

The malicious APK packages operate as droppers that launch the next stages of the infection.

The use of social engineering combined with technical anti-analysis mechanisms makes the malware difficult to identify through traditional detection methods alone.

Why RatHat Is Significant

RatHat combines several techniques that increase the potential impact of an Android compromise.

The malware combines Accessibility abuse, local ADB access, reverse tunneling, credential theft, surveillance capabilities, persistence mechanisms, and AI-assisted navigation within a single attack chain.

Zimperium researchers noted that the malware's multi-tier architecture, use of daemons outside the normal application lifecycle, and real-time generative AI decision-making demonstrate challenges for traditional signature-based mobile security controls.

The findings highlight the increasing use of AI technologies within malicious software and demonstrate how AI-assisted automation could allow attackers to interact with mobile applications more dynamically.