RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...

Indicators of Compromise

• domain: admin.chunhuating.best
• domain: admin.xiongmaocs.pics
• domain: admin.rathat.live
• url: https://dramaspoolcoa.com/en.html
• url: https://rathat.me/app-release-rat-hat-live.apk
• hash: 116346cace7f00ba557034b534d40791
• hash: 8fdc21e25097a46528211274e54330e1
• hash: f83357b2d47c7d38ee53943373961211