This analysis covers advanced Android threats that operate beyond the standard application sandbox, leveraging new OS-level telemetry features. Android's Delegated Scope allows enterprises to grant security apps access to logs on managed devices without full MDM control. The Intrusion Logging feature extends forensic visibility to BYOD users with Advanced Protection on Android 16 or later. This capability enables collection and sharing of encrypted security, DNS, and connection logs for threat analysis. The analysis reveals the full RatHat attack chain, including Wireless Debugging self-pairing, ADB shell command execution, daemon staging, and command-and-control communications, providing actionable indicators of compromise.
RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...