RatHat is a newly documented Android banking trojan, analyzed and named by Zimperium's zLabs research team in a report published September 16, 2026, that pairs live generative-AI-driven UI automation with abuse of two legitimate Android subsystems -- the Accessibility Service and Android Debug Bridge (ADB) Wireless Debugging -- to achieve persistent, shell-level control of infected devices and steal financial credentials.

Infection begins with social engineering: victims are lured via smishing (SMS phishing) messages and malvertising campaigns to deceptive third-party download portals and phishing sites that serve a malicious APK disguised as a legitimate app. Zimperium's IOC data shows a live distribution site, kingbss.com, pushing the payload under the fake app name "Nexus One"; other researchers separately observed builds masquerading as Disney+, ZEE5, and Chrome, with one APK hosted directly on AWS S3 (x14hidgz0ez.s3.ap-south-1.amazonaws.com) and fronted via the phishing subdomain sel6bu6eft06.primevoria.com. After sideloading, the app exploits native SessionInstaller APIs to bypass Android's restricted-settings and Accessibility Service protections during installation, then displays fake warnings (e.g., claiming a network restriction or a financial-benefit requirement, or a bogus Google Play Store page) to coerce the victim into granting Accessibility Service permission.

Once Accessibility access is granted, RatHat's automation layer (internally staged via a component multiple outlets refer to as "SystemHelper") serializes the device's live Accessibility node tree into XML and sends it to a generative-AI assistant -- the Zimperium report deliberately declines to name the specific model or provider, describing it only as "one of the world's most popular Generative AI assistants," but researchers found LLM prompts written in Chinese/Mandarin, consistent with their assessment that RatHat is operated by China-based threat actors; secondary reporting from PCRisk and Infosecurity Magazine independently identifies the assistant as Google Gemini, though this is not confirmed in Zimperium's own primary write-up. The AI resolves on-screen coordinates and text and returns navigation instructions (e.g., SCROLL_DOWN), which the malware executes as synthetic taps via Android's accessibility input-injection APIs. Using this technique the malware autonomously taps Build Number seven times to unlock Developer Options, enables Wireless Debugging, opens the ADB pairing dialog, and reads the temporary six-digit pairing code and dynamic port directly off the screen. It then authenticates to the local ADB daemon (via an embedded libadb-android implementation) and obtains a shell in /data/local/tmp -- escaping the normal Android application sandbox entirely without exploiting any software vulnerability.

From that shell, RatHat drops two native ELF binaries disguised as native libraries: liblocal-service.so, a Go-based privileged local agent that binds an HTTP command/telemetry server to 127.0.0.1:7910 and issues OS-level commands (dumpsys deviceidle whitelist, am set-standby-bucket, pm disable-user, pm install/uninstall) to exempt itself from Doze/battery restrictions and manage the app's install state; and libmedia_codec.so, a reverse-proxy client built on the open-source fatedier/frp project that establishes a persistent reverse tunnel to attacker infrastructure over both HTTPS and WSS, exposing the device's loopback services and interfaces to the operator and bypassing NAT/firewall boundaries. Because the Go agent runs outside the visible app's process/package lifecycle, it survives uninstallation of the RatHat app: it intercepts the uninstall-confirmation flow with a fake Google Play failure overlay, monitors installation state via scheduled alarms and account-sync watchdog components, and silently reissues pm install -r -g -i com.android.packageinstaller against a cached APK to reinstall the malware and re-grant Accessibility (via settings put secure enabled_accessibility_services / accessibility_enabled) without any further user interaction. A heartbeat check redeploys the local-service daemon if it is stopped.

For credential theft, RatHat monitors foreground-application activity and, when a targeted banking or payment app comes to the foreground, injects operator-supplied HTML content as a full-screen overlay to phish credentials directly. Named targets span Bank of America and unnamed Russian-language banking apps (per PCRisk) alongside WeChat Pay and Alipay, which present victims with Chinese-language "identity verification" screens requesting six-digit payment PINs. In parallel, the Go agent invokes Android's built-in getevent diagnostic utility to read raw /dev/input touch events (X/Y coordinates and timestamps) and correlates them against a bundled locateValues.json file containing precise keypad and pattern-lock geometry for major device brands, allowing it to reconstruct lock-screen PINs and pattern unlocks purely from touch coordinates -- a technique that bypasses FLAG_SECURE, custom keyboards, and other on-screen lock-screen protections; recovered credentials are internally tagged PASSWORD_QUALITY_TOUCH_POINTS. RatHat additionally registers an SMS receiver and abuses notification-listener access to intercept incoming SMS bodies (including one-time passwords and MFA codes), captures keystrokes and URLs typed into browser address bars, records the screen via the MediaProjection API with chunked video upload to the C2, and collects browsing history from Chrome, Brave, Opera, Edge, DuckDuckGo, and Samsung Internet, as well as an inventory of installed applications.

Command and control runs over HTTP/WebSocket with HMAC-SHA256 request authentication derived from a per-device key salt and a persistent heartbeat WebSocket. Documented endpoints include /api/node/register (enrollment), /api/data/credentials, /api/data/messages, /api/data/cipher (lock-screen material), /api/tun/config (FRP tunnel parameters), /api/v2/dev/tasks (task/command queue), /api/v2/dev/localServiceHeartbeat, /api/v2/dev/data/screen-monitor, /api/v2/dev/upload/video, plus operator evasion/block lists at /api/sapp and /api/bapp. Zimperium's published IOC repository (github.com/Zimperium/IOC, path 2026-09-RatHat) enumerates 256 distinct SHA-256 APK hashes, 16 live/recently-live C2 domains split between HTTPS admin/config endpoints (e.g., fegrs.adidasabc.com, admin.xiongmaocs.help, blackcat880.shop, cheng770.cyou) and WSS command-channel endpoints (e.g., admin.xiongmaocs.mom, admin.niaotong2.top, heilongyk.top, cz.gpgmk.com), and phishing/distribution infrastructure. A follow-up report (SSBCrack, Sept 20 2026) puts at least 162 distinct malicious applications observed actively communicating with this attacker-controlled infrastructure. Independent removal-guide research (PCRisk) also published a specific sample hash (SHA-256 018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5) with cross-vendor AV detection names: Avast-Mobile (Android:Evo-gen [Trj]), Combo Cleaner (Android.Riskware.Agent.aDKHB), ESET-NOD32 (Android/Spy.Agent.EZF Trojan), and Kaspersky (HEUR:Trojan-Clicker.AndroidOS.Simpo.c).

The dropper itself employs four distinct anti-analysis techniques to resist static/dynamic triage: container tampering (declaring archive entries as directories or setting spurious ZIP-encryption flags to break Android's libziparchive parser), a manifest bomb (an undocumented 0x9999 chunk header injected into a 61MB AndroidManifest.xml to crash analysis tooling), DEX bytecode poisoning (pseudo-instructions carrying invalid element_width attributes), and dual Base64-based string encryption (StringFog plus StringCrypto) to hide strings and configuration, layered with six runtime anti-debugging/anti-instrumentation checks (debugger-attach detection, TracerPid inspection, FLAG_DEBUGGABLE/ro.debuggable checks, Frida port/process/library scanning, and root/Xposed/emulator artifact checks).

No CVE or CVSS score applies -- RatHat achieves shell-level device compromise entirely by abusing legitimate, user-grantable Android features (Accessibility Service, Wireless Debugging) combined with social engineering, not a software vulnerability.