A new, highly sophisticated Android malware called RatHat has been discovered, using artificial intelligence (AI) to automate device control and evade detection. This malware, linked to threat actors from China, targets users with an AI-powered subsystem that helps operators remotely navigate compromised devices.
RatHat is distributed through various channels, including malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play. Once installed, the malware abuses Android’s Accessibility permissions to perform highly privileged actions on infected devices. It enables Developer Options and Wireless Debugging, allowing the attacker to gain a local shell-level execution context without requiring an external computer.
The malware also installs two agents: a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, creates battery-restriction bypasses, and manages persistence; and a second agent (libmedia_codec.so) that acts as an FRP reverse-proxy client, establishing a persistent tunnel to the attacker. The malware can intercept SMS messages and notifications, record text-change events, extract URLs from browser address bars, and capture lock-screen PINs, passwords, and unlock patterns.
What sets RatHat apart is its AI-powered user interface-automation engine, which serializes the live Android Accessibility tree into XML and sends it to a popular AI assistant. The AI tool then identifies interface elements, determines their on-screen text, and returns navigation instructions such as ‘SCROLL_DOWN’ and others. This makes RatHat’s interface automation more adaptable than traditional scripted automation, allowing remote navigation without requiring real-time interaction from the operator.
RatHat will actively thwart removal attempts by intercepting the uninstall confirmation screen and displaying a fake Google Play overlay containing a bogus error message. The malware also employs multiple anti-analysis techniques, including APK container tampering, a bloated Android manifest file, and invalid DEX pseudo instructions, aimed at confusing or breaking analysis tools.
The discovery of RatHat highlights the growing threat of AI-powered attacks on mobile devices. As these types of threats continue to evolve, it’s essential for users to take extra precautions to protect themselves. To avoid falling victim to malware like RatHat, Android users should never download APK files from outside Google Play unless they explicitly trust the publisher, and regularly scan their devices with Play Protect.
In addition, users should be cautious when granting Accessibility permissions to apps, as this can compromise device security. By being vigilant and taking proactive steps to secure their devices, users can minimize the risk of falling victim to sophisticated malware like RatHat.
Source: Bleeping Computer — 2026-09-17