{"id":21637,"date":"2026-09-23T13:54:59","date_gmt":"2026-09-23T17:54:59","guid":{"rendered":"https:\/\/www.psafe.com\/en\/blog\/?p=21637"},"modified":"2026-09-23T13:56:08","modified_gmt":"2026-09-23T17:56:08","slug":"rathat-android-malware-ai-adb","status":"publish","type":"post","link":"https:\/\/www.psafe.com\/en\/blog\/rathat-android-malware-ai-adb\/","title":{"rendered":"RatHat Android malware: how AI and permissions are used"},"content":{"rendered":"

RatHat Android malware drew attention because it uses artificial intelligence during an attack. The more useful part of the story is the path it takes through a phone. According to Zimperium’s analysis, the malicious app relies on a manual install and tries to gain access to powerful Android features, including Accessibility and Wireless Debugging. Those permissions can help it capture bank logins, PINs, and one-time codes.<\/span><\/p>\n

Public reporting does not confirm a mass campaign, Google Play distribution, or specific targeting in the United States. This article covers what researchers found, which choices allow the attack to progress, and what you can check without treating every unusual phone problem as evidence of RatHat.<\/span><\/p>\n

What is RatHat Android malware?<\/b><\/h2>\n

RatHat is the name Zimperium’s zLabs team gave to Android malware found in samples distributed through fake messages, malicious ads, and deceptive download pages. Zimperium published its<\/span> technical analysis of RatHat<\/span><\/a> on September 16, 2026.<\/span><\/p>\n

Researchers found tools that imitate app screens, monitor activity, and intercept codes from text messages or notifications. RatHat also tries to keep components running after the main app is removed. Zimperium observed that behavior in the samples it studied. The report does not establish that every infection follows the same sequence or that the malware has reached a large number of people.<\/span><\/p>\n

AI helps the malware locate screen elements and choose where to tap. It does not install the file on its own. The chain begins when someone downloads an APK outside the official store and approves access that deserves closer attention.<\/span><\/p>\n

How does RatHat reach a phone?<\/b><\/h2>\n

The route described by Zimperium starts with social engineering. A text, ad, or webpage pretends to come from a familiar source and offers an APK file. One sample posed as a streaming service and could change its name and icon.<\/span><\/p>\n

An APK is the file format Android uses to install apps. A file from outside the official store is not automatically malicious. Risk rises when you cannot confirm its source, the download arrives unexpectedly, or the app requests controls that make no sense for its stated purpose.<\/span><\/p>\n

Before installing, check the developer, the web address, and the reason the app is unavailable in the store. If the offer came through a message or ad, find the service through a known route instead of the supplied link.<\/span> Google Play Protect<\/span><\/a> can also scan apps from other sources, though no security tool can promise perfect detection.<\/span><\/p>\n

Three permissions help the attack progress<\/b><\/h2>\n

The RatHat chain combines three decisions that appear on the Android screen.<\/span><\/p>\n

    \n
  1. The user installs an APK obtained outside the store. The file opens the initial path and tries to look legitimate.<\/span><\/li>\n
  2. The app requests Accessibility access. Android provides this feature to help people use their devices, but malicious software can abuse it to read the screen and perform taps.<\/span><\/li>\n
  3. The malware tries to enable Developer options and Wireless Debugging. It then uses ADB to gain control beyond the permissions normally available to an app.<\/span><\/li>\n<\/ol>\n

    ADB stands for Android Debug Bridge. Developers and repair technicians use it to test devices and run commands. Wireless Debugging provides that connection without a cable. Most users should leave it off when they do not need it.<\/span><\/p>\n

    RatHat uses Accessibility to move through settings, capture a pairing code, and create a local ADB connection. Its AI-assisted automation helps it find buttons and text across different interfaces. This makes the process more adaptable, but the earlier install and permissions still matter.<\/span><\/p>\n

    Related:<\/b> Review which apps can access sensitive Android features<\/span><\/a><\/p>\n

    Is RatHat targeting people in the US?<\/b><\/h2>\n

    As of September 22, 2026, public sources did not confirm a campaign focused on the United States, a victim count, or affected US banks. Zimperium describes global financial targeting in the samples but does not provide a country list.<\/span><\/p>\n

    That gap matters when reading headlines. RatHat documents a possible attack technique. It does not give us grounds to label every unknown APK or slow phone as a RatHat infection. The checks below still help because they reduce common risks from malicious Android apps.<\/span><\/p>\n

    Which signs deserve a closer look?<\/b><\/h2>\n

    One symptom cannot identify RatHat. Look for the surrounding context, such as a recent install from an unknown source and permissions you do not remember approving.<\/span><\/p>\n