AI-Powered Android Malware RedHat Survives Deletion and Steals Banking Credentials

• •RedHat malware uses AI to adapt to banking app changes and steal credentials.
• •The malware can reinstall itself and block uninstallation attempts.
• •Cisco's CVE-2026-76460 is actively exploited, posing a critical risk to users.

A new Android banking trojan named RedHat has been discovered, featuring an AI component that allows it to adapt to changes in banking app layouts. This malware can create invisible overlays to capture user credentials and one-time passwords, effectively controlling victims' banking accounts. It is distributed through third-party app stores, social media, and malvertising, requiring Accessibility permissions to operate. Notably, RedHat can reinstall itself after deletion and block uninstall attempts by displaying fake error messages. Cisco has also reported a critical zero-day vulnerability (CVE-2026-76460) in its Identity Services Engine, which has been actively exploited, allowing unauthorized access to affected systems. Organizations using Cisco ISE are urged to patch their systems immediately to mitigate risks. The situation highlights the growing intersection of AI and malware, raising concerns for cybersecurity professionals.