Imagine malware that not only steals your passwords but also learns to navigate your phone on its own. That's RatHat , a newly discovered banking Trojan that uses artificial intelligence to navigate your device's screen and extract financial data with minimal human intervention. Researchers have labeled it one of the most sophisticated threats seen so far on Android.
The discovery comes from Zimperium zLabs, a firm specializing in mobile security. According to their analysis, the malware is distributed through smishing campaigns and malicious advertising that redirect users to fake download pages. Experts highlight its ability to adapt to changes in applications, which makes it very difficult to detect using traditional methods.
An AI assistant to steal your data
What distinguishes RatHat from other Trojans is its ability to interpret the screen in real time . It uses the device's accessibility tree, converts it to XML, and sends it to an AI assistant that tells it where to tap, what text is in each element, and when to scroll. Thus, if a banking app changes its design, the malware adapts automatically, something that previously forced cybercriminals to manually update its coordinates.
Furthermore, to steal credentials, the Trojan creates fake overlays on banking apps that capture your passwords and one-time codes. It also intercepts SMS messages to steal OTPs sent by the bank and can record your screen using the MediaProjection API. All of this is sent to the attackers' server, allowing them to empty your account without you even noticing.
How it hides and how to protect yourself
RatHat doesn't just steal; it also makes sure it stays put . It abuses ADB wireless debugging, a legitimate developer tool, to escape the sandbox and execute commands as if it were a system process. Even if you uninstall the visible app, it can reinstall itself from a hidden component, and it displays a fake Google Play error if you try to delete it. Therefore, researchers recommend a factory reset if you are infected.
To avoid falling into the trap, the basics still work: it's essential to download only from Google Play , be wary of any app that requests accessibility permissions without justification, and never enable developer options unless you know what you're doing. It's also helpful to use up-to-date anti-malware software, which detects RatHat as Android/Trojan.Exploit.RatHat.
It's clear that the combination of AI and cybercrime is a real threat , but with safe downloading habits, careful permissions, and a good antivirus, you can reduce the chances of falling victim to these types of scams to almost zero. Prevention remains your best defense.