# RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs, and MFA Codes

> Zimperium zLabs disclosed RatHat, an Android banking trojan that serializes the device's live Accessibility tree to XML and sends it to a generative-AI assistant (secondary reporting identifies it as Google Gemini; Zimperium's original report declines to name it) so the malware can autonomously decide where to tap, scroll, and type rather than relying on hardcoded automation scripts. It abuses Accessibility permissions to silently enable Wireless Debugging, self-pairs with the local ADB daemon to gain shell-level control, drops two masqueraded Go-based native binaries that persist independently of the visible app (including one that auto-reinstalls the malware after uninstall via a fake Google Play failure overlay), and steals banking credentials, lock-screen PINs/patterns, and SMS-based MFA codes via HTML-injection overlays, raw touch-input logging, and SMS/notification interception. Zimperium's published IOC set documents 256 malicious APK hashes and 16 live C2 domains, and a follow-up report puts at least 162 malicious apps in active contact with the attacker infrastructure.

- **Published:** 2026-09-20T00:00:00Z
- **Last reviewed:** 2026-09-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2592
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rathat-android-ai-banker-tl-2026-2592.webp?v=30414f3c (Threadlinqs threat intel: RatHat AI-Powered Android Banking Trojan: Detection & IOCs (TL-2026-2592) — High severity, 65 IOCs, 9 detection rules.)
- **ID:** TL-2026-2592
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 65 (3 shown free below)

## Description

RatHat is a newly documented Android banking trojan, analyzed and named by Zimperium's zLabs research team in a report published September 16, 2026, that pairs live generative-AI-driven UI automation with abuse of two legitimate Android subsystems -- the Accessibility Service and Android Debug Bridge (ADB) Wireless Debugging -- to achieve persistent, shell-level control of infected devices and steal financial credentials.

Infection begins with social engineering: victims are lured via smishing (SMS phishing) messages and malvertising campaigns to deceptive third-party download portals and phishing sites that serve a malicious APK disguised as a legitimate app. Zimperium's IOC data shows a live distribution site, kingbss.com, pushing the payload under the fake app name "Nexus One"; other researchers separately observed builds masquerading as Disney+, ZEE5, and Chrome, with one APK hosted directly on AWS S3 (x14hidgz0ez.s3.ap-south-1.amazonaws.com) and fronted via the phishing subdomain sel6bu6eft06.primevoria.com. After sideloading, the app exploits native SessionInstaller APIs to bypass Android's restricted-settings and Accessibility Service protections during installation, then displays fake warnings (e.g., claiming a network restriction or a financial-benefit requirement, or a bogus Google Play Store page) to coerce the victim into granting Accessibility Service permission.

Once Accessibility access is granted, RatHat's automation layer (internally staged via a component multiple outlets refer to as "SystemHelper") serializes the device's live Accessibility node tree into XML and sends it to a generative-AI assistant -- the Zimperium report deliberately declines to name the specific model or provider, describing it only as "one of the world's most popular Generative AI assistants," but researchers found LLM prompts written in Chinese/Mandarin, consistent with their assessment that RatHat is operated by China-based threat actors; secondary reporting from PCRisk and Infosecurity Magazine independently identifies the assistant as Google Gemini, though this is not confirmed in Zimperium's own primary write-up. The AI resolves on-screen coordinates and text and returns navigation instructions (e.g., SCROLL_DOWN), which the malware executes as synthetic taps via Android's accessibility input-injection APIs. Using this technique the malware autonomously taps Build Number seven times to unlock Developer Options, enables Wireless Debugging, opens the ADB pairing dialog, and reads the temporary six-digit pairing code and dynamic port directly off the screen. It then authenticates to the local ADB daemon (via an embedded libadb-android implementation) and obtains a shell in /data/local/tmp -- escaping the normal Android application sandbox entirely without exploiting any software vulnerability.

From that shell, RatHat drops two native ELF binaries disguised as native libraries: liblocal-service.so, a Go-based privileged local agent that binds an HTTP command/telemetry server to 127.0.0.1:7910 and issues OS-level commands (dumpsys deviceidle whitelist, am set-standby-bucket, pm disable-user, pm install/uninstall) to exempt itself from Doze/battery restrictions and manage the app's install state; and libmedia_codec.so, a reverse-proxy client built on the open-source fatedier/frp project that establishes a persistent reverse tunnel to attacker infrastructure over both HTTPS and WSS, exposing the device's loopback services and interfaces to the operator and bypassing NAT/firewall boundaries. Because the Go agent runs outside the visible app's process/package lifecycle, it survives uninstallation of the RatHat app: it intercepts the uninstall-confirmation flow with a fake Google Play failure overlay, monitors installation state via scheduled alarms and account-sync watchdog components, and silently reissues pm install -r -g -i com.android.packageinstaller against a cached APK to reinstall the malware and re-grant Accessibility (via settings put secure enabled_accessibility_services / accessibility_enabled) without any further user interaction. A heartbeat check redeploys the local-service daemon if it is stopped.

For credential theft, RatHat monitors foreground-application activity and, when a targeted banking or payment app comes to the foreground, injects operator-supplied HTML content as a full-screen overlay to phish credentials directly. Named targets span Bank of America and unnamed Russian-language banking apps (per PCRisk) alongside WeChat Pay and Alipay, which present victims with Chinese-language "identity verification" screens requesting six-digit payment PINs. In parallel, the Go agent invokes Android's built-in getevent diagnostic utility to read raw /dev/input touch events (X/Y coordinates and timestamps) and correlates them against a bundled locateValues.json file containing precise keypad and pattern-lock geometry for major device brands, allowing it to reconstruct lock-screen PINs and pattern unlocks purely from touch coordinates -- a technique that bypasses FLAG_SECURE, custom keyboards, and other on-screen lock-screen protections; recovered credentials are internally tagged PASSWORD_QUALITY_TOUCH_POINTS. RatHat additionally registers an SMS receiver and abuses notification-listener access to intercept incoming SMS bodies (including one-time passwords and MFA codes), captures keystrokes and URLs typed into browser address bars, records the screen via the MediaProjection API with chunked video upload to the C2, and collects browsing history from Chrome, Brave, Opera, Edge, DuckDuckGo, and Samsung Internet, as well as an inventory of installed applications.

Command and control runs over HTTP/WebSocket with HMAC-SHA256 request authentication derived from a per-device key salt and a persistent heartbeat WebSocket. Documented endpoints include /api/node/register (enrollment), /api/data/credentials, /api/data/messages, /api/data/cipher (lock-screen material), /api/tun/config (FRP tunnel parameters), /api/v2/dev/tasks (task/command queue), /api/v2/dev/localServiceHeartbeat, /api/v2/dev/data/screen-monitor, /api/v2/dev/upload/video, plus operator evasion/block lists at /api/sapp and /api/bapp. Zimperium's published IOC repository (github.com/Zimperium/IOC, path 2026-09-RatHat) enumerates 256 distinct SHA-256 APK hashes, 16 live/recently-live C2 domains split between HTTPS admin/config endpoints (e.g., fegrs.adidasabc.com, admin.xiongmaocs.help, blackcat880.shop, cheng770.cyou) and WSS command-channel endpoints (e.g., admin.xiongmaocs.mom, admin.niaotong2.top, heilongyk.top, cz.gpgmk.com), and phishing/distribution infrastructure. A follow-up report (SSBCrack, Sept 20 2026) puts at least 162 distinct malicious applications observed actively communicating with this attacker-controlled infrastructure. Independent removal-guide research (PCRisk) also published a specific sample hash (SHA-256 018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5) with cross-vendor AV detection names: Avast-Mobile (Android:Evo-gen [Trj]), Combo Cleaner (Android.Riskware.Agent.aDKHB), ESET-NOD32 (Android/Spy.Agent.EZF Trojan), and Kaspersky (HEUR:Trojan-Clicker.AndroidOS.Simpo.c).

The dropper itself employs four distinct anti-analysis techniques to resist static/dynamic triage: container tampering (declaring archive entries as directories or setting spurious ZIP-encryption flags to break Android's libziparchive parser), a manifest bomb (an undocumented 0x9999 chunk header injected into a 61MB AndroidManifest.xml to crash analysis tooling), DEX bytecode poisoning (pseudo-instructions carrying invalid element_width attributes), and dual Base64-based string encryption (StringFog plus StringCrypto) to hide strings and configuration, layered with six runtime anti-debugging/anti-instrumentation checks (debugger-attach detection, TracerPid inspection, FLAG_DEBUGGABLE/ro.debuggable checks, Frida port/process/library scanning, and root/Xposed/emulator artifact checks).

No CVE or CVSS score applies -- RatHat achieves shell-level device compromise entirely by abusing legitimate, user-grantable Android features (Accessibility Service, Wireless Debugging) combined with social engineering, not a software vulnerability.

## MITRE ATT&CK

- T1660 Phishing
- T1516 Input Injection
- T1623 Command and Scripting Interpreter
- T1575 Native API
- T1453 Abuse Accessibility Features
- T1417.002 GUI Input Capture
- T1461 Lockscreen Bypass
- T1418 Software Discovery
- T1633.001 System Checks
- T1406 Obfuscated Files or Information
- T1406.002 Software Packing
- T1629 Impair Defenses
- T1407 Download New Code at Runtime
- T1513 Screen Capture
- T1517 Access Notifications
- T1636.004 SMS Messages
- T1533 Data from Local System
- T1437 Application Layer Protocol
- T1604 Proxy Through Victim

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RatHat — C2 Beaconing to Published Domains and FRP Reverse-Tunnel / Loopback Command Channel** (`TL-2026-2592-SPL-003`)

Detects network-layer C2 activity: DNS/proxy contact with any of Zimperium's 16 published RatHat C2 domains (HTTPS admin/config: fegrs.adidasabc.com, admin.xiongmaocs.help, blackcat880.shop, cheng770.cyou; WSS command channel: admin.xiongmaocs.mom, admin.niaotong2.top, heilongyk.top, cz.gpgmk.com) hitting the documented endpoint set (/api/node/register, /api/data/credentials, /api/data/messages, /api/data/cipher, /api/tun/config, /api/v2/dev/tasks, /api/v2/dev/localServiceHeartbeat, /api/v2/dev/upload/video), combined with an on-device loopback listener on 127.0.0.1:7910 (liblocal-service.so) and an outbound persistent WSS/HTTPS reverse-tunnel matching the fatedier/frp client fingerprint (libmedia_codec.so) — the C2/lateral-movement/proxy stage that carries stolen credentials, SMS/OTP content, and reconstructed lock-screen material off the device.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1437, T1604, T1517, T1636.004, T1513, T1461, T1417.002, T1533, T1418
- **Data sources:** DNS query logs, web/HTTP(S) proxy logs, firewall/egress flow logs, on-device netstat/loopback-listener telemetry (MTD/EDR)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=dns OR index=proxy OR index=firewall)
  (dest_host="fegrs.adidasabc.com" OR dest_host="admin.xiongmaocs.help" OR dest_host="blackcat880.shop" OR dest_host="cheng770.cyou" OR dest_host="oop.uuokxx.com" OR dest_host="andxxxo.com" OR dest_host="admin.xiongmaocs.mom" OR dest_host="admin.xiongmaocs.pics" OR dest_host="admin.fjbjwgyuyftg.qpon" OR dest_host="admin.niaotong2.top" OR dest_host="heilongyk.top" OR dest_host="cz.gpgmk.com" OR dest_host="cunzhang.krgdef.cn" OR dest_host="bc.etlva.cn" OR dest_host="jiaozhu.etlva.cn" OR dest_host="mao.terh5.cn")
| eval uri_path=coalesce(uri_path,http_uri)
| eval c2_endpoint=case(
    like(uri_path,"%/api/node/register%"),"register",
    like(uri_path,"%/api/data/credentials%"),"credentials_exfil",
    like(uri_path,"%/api/data/messages%"),"sms_exfil",
    like(uri_path,"%/api/data/cipher%"),"lockscreen_exfil",
    like(uri_path,"%/api/tun/config%"),"tunnel_config",
    like(uri_path,"%/api/v2/dev/tasks%"),"task_poll",
    like(uri_path,"%/api/v2/dev/localServiceHeartbeat%"),"heartbeat",
    like(uri_path,"%/api/v2/dev/upload/video%"),"screen_video_exfil",
    1=1,"other")
| join type=left src_host
  [ search index=mtd OR index=edr sourcetype="android:netstat" local_addr="127.0.0.1" local_port=7910
  | eval loopback_hit=1 ]
| table _time src_host dest_host uri_path c2_endpoint loopback_hit
| sort -_time
```

### Microsoft KQL

```kql
let RatHatC2Domains = dynamic(["fegrs.adidasabc.com","admin.xiongmaocs.help","blackcat880.shop","cheng770.cyou","oop.uuokxx.com","andxxxo.com","admin.xiongmaocs.mom","admin.xiongmaocs.pics","admin.fjbjwgyuyftg.qpon","admin.niaotong2.top","heilongyk.top","cz.gpgmk.com","cunzhang.krgdef.cn","bc.etlva.cn","jiaozhu.etlva.cn","mao.terh5.cn"]);
let RatHatEndpoints = dynamic(["/api/node/register","/api/data/credentials","/api/data/messages","/api/data/cipher","/api/tun/config","/api/v2/dev/tasks","/api/v2/dev/localServiceHeartbeat","/api/v2/dev/upload/video"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (RatHatC2Domains)
| extend MatchedEndpoint = extract(strcat("(", strcat_array(RatHatEndpoints, "|"), ")"), 1, RemoteUrl)
| project Timestamp, DeviceId, RemoteUrl, MatchedEndpoint
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where LocalIP == "127.0.0.1" and LocalPort == 7910
    | project DeviceId, LoopbackHit = 1
) on DeviceId
| sort by Timestamp desc
```

### Sigma

```yaml
title: RatHat C2 Domain Contact with Documented Endpoint Path
id: 4c8e1a3f-9d5b-4e7c-8a2f-6b1d3c9e5f07
status: experimental
description: Detects network contact with a published RatHat C2 domain (HTTPS admin/config or WSS command channel) combined with one of the documented C2 API endpoint paths used for enrollment, credential/SMS/lock-screen exfiltration, tunnel configuration, task polling, or screen-video upload.
references:
    - https://github.com/Zimperium/IOC/tree/master/2026-09-RatHat/
    - https://gbhackers.com/ai-powered-rathat-android-trojan-steals-bank-credentials/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-20
tags:
    - attack.command_and_control
    - attack.t1437
    - attack.t1604
    - attack.collection
    - attack.t1517
    - attack.t1636.004
    - attack.t1513
    - attack.credential_access
    - attack.t1461
    - attack.t1417.002
    - attack.tool.rathat
logsource:
    category: proxy
    product: android
detection:
    sel_domain:
        c-uri-host|contains:
            - 'fegrs.adidasabc.com'
            - 'admin.xiongmaocs.help'
            - 'blackcat880.shop'
            - 'cheng770.cyou'
            - 'admin.xiongmaocs.mom'
            - 'admin.niaotong2.top'
            - 'heilongyk.top'
            - 'cz.gpgmk.com'
    sel_endpoint:
        c-uri|contains:
            - '/api/node/register'
            - '/api/data/credentials'
            - '/api/data/messages'
            - '/api/data/cipher'
            - '/api/tun/config'
            - '/api/v2/dev/tasks'
            - '/api/v2/dev/localServiceHeartbeat'
            - '/api/v2/dev/upload/video'
    condition: sel_domain and sel_endpoint
falsepositives:
    - None expected; these are attacker-registered domains with no known legitimate use. Newly-observed sibling domains sharing the same registrar/naming pattern warrant the same treatment pending confirmation
level: critical
```

**Known false positives:**

- None expected for the listed exact-match C2 domains; if extending to newly-observed sibling infrastructure discovered via OSINT/community corroboration, treat those as medium-confidence until independently confirmed to avoid false positives on shared hosting providers

**Tuning notes:** Feed the C2 domain list from a lookup synced against Zimperium's c2.csv rather than hardcoding it, since RatHat operators rotate WSS command-channel hosts faster than HTTPS admin domains; consider a lower-confidence companion rule on the loopback-listener signature (127.0.0.1:7910) alone for devices where full URL/path visibility is unavailable (e.g. TLS-inspected-only proxy logs). TL_OSINT_Scan community corroboration for this threat currently shows 0 directly-matched IOCs and flags 37 related sibling domains from a separate malvertising campaign (fake Claude/Codex install-page lures, e.g. codex-notes.com, claude-macos-app.com) — that cluster is NOT confirmed RatHat infrastructure and should not be added to this rule without independent validation; monitor for future OSINT updates that directly corroborate RatHat's own C2 set.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RatHat — Malicious APK Hash or Cross-Vendor Detection Name Observed on Managed Fleet (locked: unlock with TL Creds)
- RatHat — Native Go Binaries Staged and Executed from [indicator] (locked: unlock with TL Creds)
- RatHat — getevent Touch-Coordinate Logging and [indicator] PIN/Pattern Reconstruction (locked: unlock with TL Creds)
- RatHat — SessionInstaller API Abuse to Bypass Restricted-Settings During Sideload (locked: unlock with TL Creds)
- RatHat — Uninstall-Resistant Auto-Reinstall and Silent Accessibility Re-Grant (locked: unlock with TL Creds)
- RatHat — HTML-Injection Overlay Over Foregrounded Banking/Payment App (locked: unlock with TL Creds)
- RatHat — Sideload Lure Followed by Accessibility Grant and Rapid Developer-Options Unlock (locked: unlock with TL Creds)
- RatHat — ADB Wireless-Debugging Self-Pairing and Shell-Level Doze/Standby Manipulation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 65)

Defanged, TLP:CLEAR.

- Domain: `fegrs[.]adidasabc[.]com`
- URL: `hxxps://x14hidgz0ez[.]s3[.]ap-south-1[.]amazonaws[.]com/Xr9HBk23fX.apk`
- File hash: `018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5`

Full set of 65 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts](https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts)
- [Zimperium/IOC — 2026-09-RatHat indicator repository (apks.csv, c2.csv, phishing.csv)](https://github.com/Zimperium/IOC/tree/master/2026-09-RatHat/)
- [New 'RatHat' Android Malware Leverages AI to Steal Financial Data](https://www.infosecurity-magazine.com/news/rathat-android-malware-ai-steal/)
- [New RatHat Android malware uses AI to automate device control](https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/)
- [Zimperium zLabs Uncovers RatHat Mobile Malware](https://www.securityinformed.com/news/zimperium-unveils-rathat-ai-mobile-malware-co-1641807473-ga.1789630690.html)
- [New RatHat Android Malware Uses AI and ADB to Steal Banking Credentials and OTPs](https://cyberpress.org/rathat-steals-banking-otps/)
- [RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs](https://gbhackers.com/rathat-malware-attack/)
- [New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report](https://dailyhodl.com/2026/09/18/new-android-malware-uses-ai-to-steal-banking-logins-and-control-phones-report/)
- [RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall](https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html)
- [RatHat Malware (Android) - Malware removal instructions](https://www.pcrisk.com/removal-guides/35947-rathat-malware-android)
- [AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes](https://gbhackers.com/ai-powered-rathat-android-trojan-steals-bank-credentials/)
- [New AI-Powered Malware RatHat Poses Serious Threat to Android Users](https://news.ssbcrack.com/new-ai-powered-malware-rathat-poses-serious-threat-to-android-users/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2592