As reported by BleepingComputer, Zimperium zLabs has uncovered a new Android banking malware family called RatHat that integrates an LLM-powered subsystem to automate real-time device navigation. This is not merely another accessibility-abusing trojan — it represents a meaningful inflection point in how mobile malware adapts to diverse device states and app versions without operator intervention.

Threat Alert: As reported by BleepingComputer, Zimperium zLabs has uncovered a new Android banking malware family called RatHat that integrates an LLM-powered subsystem to automate real-time device navigation.

Why RatHat is different

Most Android banking trojan families — from FluBot to Anatsa — rely on hardcoded overlay templates and scripted UI automation that break when target apps update their layouts. RatHat sidesteps this fragility by serializing the live Android Accessibility tree into XML and dispatching it to an AI assistant that returns element coordinates, text content, and navigation commands like SCROLL_DOWN. This effectively turns a static automation engine into a context-aware one, allowing the malware to adapt to UI changes across OEM skins, app versions, and language settings without operator reprogramming.

The dual-agent architecture — liblocal-service.so for persistence and libmedia_codec.so for reverse-proxy tunneling — demonstrates a maturity in design. The mutual restoration mechanism, where the malware and Go agent each restore the other if removed, creates a resilient infection that standard cleanup workflows may miss.

Who is at risk

  • BYOD enterprise users who side-load apps outside Google Play, especially in organizations without MDM-enforced installation restrictions
  • Banking and cryptocurrency app users on Android — the primary overlay targets for credential capture
  • Users in regions with high sideloading rates or where SMS phishing is culturally normalized (e.g., package delivery lures)
  • Organizations relying on SMS-based MFA — RatHat's SMS interception capability can silently defeat OTP workflows

Broader implications

RatHat validates what threat researchers have anticipated: generative AI lowers the operational burden for attackers by replacing human-in-the-loop navigation with autonomous, adaptable agents. This model will almost certainly proliferate. Expect future variants to expand beyond banking overlays to automated enrollment in fake payment schemes, automated social media account takeover, and automated exfiltration targeting enterprise apps.

The use of Chinese-language LLM prompts is an investigative signal, not conclusive attribution — but it narrows the likely origin and suggests the operators may be leveraging domestic AI APIs less familiar to Western defenders.

Shield53 Recommendations

Shield53 Recommendations
Restrict sideloading on managed Android devices via MDM policies; block installation from unknown sources and enforce Google Play Protect
Audit Accessibility Service permissions across your mobile fleet — no legitimate consumer app should require Accessibility access unless it is an accessibility tool. Flag any grant as suspicious
Disable Wireless Debugging and Developer Options on corporate-issued devices; monitor for unexpected enablement as a detection signal
Migrate away from SMS-based MFA to app-based or hardware-key authentication where possible; SMS interception is now table stakes for modern Android malware
Deploy mobile threat defense solutions that detect known malicious APK signatures, FRP reverse-proxy behavior, and unusual Accessibility tree serialization
User education on malvertising and SMS lures remains essential — the initial infection vector requires victim interaction to install the APK
RatHat demonstrates that AI-assisted malware is no longer theoretical. Defenders must assume that future mobile threats will be context-aware, self-healing, and capable of operating without live attacker input. Mobile detection strategies anchored to static signatures and fixed UI heuristics are now insufficient.