RatHat is a sophisticated Android trojan that leverages generative AI to navigate and control infected devices in real time by reading the device's Accessibility tree and interacting with the interface. It uses a multi-stage infection process to break out of Android’s sandbox, gain shell-level execution, and obtain administrator permissions. The malware steals user credentials, mimics banking and payment apps via WebView overlays, intercepts SMS messages, and monitors user input through accessibility events, browser resource IDs, and hardware-level touch event recording using the Android debugging tool getevent. RatHat’s architecture includes a malicious Android app, a Go agent for command execution and persistence, and an FRP client for establishing a reverse proxy tunnel to the ADB daemon. It resists uninstallation by reinstalling itself via a hidden background service. The AI-driven automation and persistence mechanisms make RatHat a highly adaptable and evasive threat.

RatHat enables attackers to gain persistent, high-level control over infected Android devices, steal sensitive credentials including banking information and access codes, intercept SMS messages, and monitor user input at a hardware level. It can mimic legitimate apps to deceive users and maintain covert communication with its command-and-control infrastructure. The malware’s ability to reinstall itself after removal and evade uninstallation attempts increases the difficulty of remediation. Its use of AI for real-time device interaction enhances its adaptability and evasion, potentially increasing the success rate of attacks and the scope of data compromised.

No official patch or vendor advisory is provided for this threat. Mitigation should focus on preventing infection by avoiding smishing and malvertising campaigns, restricting installation of apps from untrusted sources, and employing mobile security solutions capable of detecting advanced malware behaviors. Users should be cautious about granting Accessibility Services and Device Admin permissions to apps. Because RatHat persists through a hidden background service and reinstalls itself, thorough device cleaning may require factory reset or specialized removal tools. Monitoring for unusual device behavior and network connections may help detect infection.