RatHat Android Malware Exploits Accessibility for Deep Device Control

• •RatHat uses AI to automate control of Android devices through Accessibility Services.
• •The malware is distributed via phishing and deceptive ads, affecting at least 162 apps.
• •It employs advanced anti-analysis techniques to evade detection and maintain persistence.

RatHat is a newly discovered Android trojan linked to China-based threat actors, utilizing AI to gain extensive control over infected devices. It is primarily distributed through deceptive phishing campaigns, malvertising, and third-party app stores, tricking users into downloading malicious APKs. Once installed, RatHat abuses Android's Accessibility Services to enable Developer Options and Wireless Debugging, allowing it to establish a local shell-level execution context. The malware can steal sensitive information, including banking credentials and PINs, and can dynamically change its appearance to evade detection. Researchers have identified at least 162 malicious apps using RatHat, which employs advanced anti-analysis techniques to complicate detection efforts. The malware's architecture includes a Go-based agent that maintains persistence even after the main app is uninstalled. Current recommendations urge users to avoid third-party app downloads and be cautious with apps requesting Accessibility permissions.