RatHat AI Malware Discovered Targeting Android Devices

Security researchers have reported the discovery of RatHat, a newly identified Android malware strain that employs artificial intelligence to automate attacks on mobile devices. The malware’s advanced features allow it to interact with device interfaces and evade common removal methods.

Zimperium’s zLabs stated that RatHat leverages an AI-powered engine to interpret and control Android user interfaces. The malware serializes the live Accessibility tree into XML and transmits this data to a generative AI assistant, which then provides navigation commands for further actions on the device.

RatHat exploits Android Accessibility permissions to activate Developer Options and enable Wireless Debugging. This process allows the malware to obtain shell-level execution privileges via Android Debug Bridge (ADB) without the need for a physical connection to a computer.

The malware installs a Go-based agent named liblocal-service.so, which executes commands with ADB shell rights. This agent also bypasses battery usage restrictions and maintains persistence on the device, even if the main malware application is removed.

What the numbers show

• RatHat’s Android manifest is 61MB in size.
• Two main components: liblocal-service.so and libmedia_codec.so.
• Discovery by Zimperium’s zLabs announced on September 16, 2026.

A secondary component, libmedia_codec.so, operates as a reverse-proxy client. This module establishes a continuous tunnel to the attacker’s command-and-control server, supporting ongoing remote access to the infected device.

RatHat uses fake HTML overlays to mimic banking and cryptocurrency applications, enabling it to collect user credentials. It can intercept SMS messages and notifications, including one-time passwords, monitor text changes, extract URLs, and capture lock-screen authentication data such as PINs, passwords, and unlock patterns.

The malware actively prevents removal by intercepting the uninstall confirmation dialog, canceling the process, and displaying a fraudulent Google Play overlay with a false error message. This tactic is designed to mislead users and block standard uninstallation procedures.

To hinder analysis and detection, RatHat employs several anti-analysis methods. These include tampering with the APK container, using an unusually large Android manifest, and inserting invalid DEX pseudo-instructions, all aimed at complicating reverse-engineering efforts by security analysts.

* This article is based on publicly available information at the time of writing.