Threats Tagged 'ai-powered automation'

RATHat is an Android banking trojan that uses a unique architecture where the malicious app acts only as an entry point. It gains Accessibility Service permissions to enable wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service operating outside Android's permission model. The operation has evolved through three Command-and-Control (C2) panel generations—BlackCat, Panda Workshop V5, and V6—between April and September 2026. These panels automate malware building, signing, and publishing, with scheduled rebuilds to evade detection. The malware-as-a-service model has seen nearly 100 deployments across Europe, Latin America, and South-Eastern Asia. AI is integrated on both malware and panel sides to enhance automation and control.