RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization

Key facts

Detection coverage

As of 2026-09-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2743 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (SPL)

Detects DNS resolution or proxy/firewall connections to documented RatHat MaaS console C2 domains across its rebrand lineage (Fisher, BlackCat Remote Control Management, Panda Workshop V5/V6), the RatHat C2 IP, RatHat APK download/landing pages, and the related PromptSpy distribution domain masquerading as a JPMorgan Chase app.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1660, T1655
• Data sources: dns_logs, proxy_logs, firewall_logs
• Severity: high
• Confidence: high

Splunk SPL

index=network sourcetype=stream:dns OR sourcetype=pan:threat
| eval domain=coalesce(query, dest_hostname, url_domain)
| search domain IN ("admin.chunhuating.best","admin.xiongmaocs.pics","admin.rathat.live","dramaspoolcoa.com","rathat.me","mgardownload.com") OR dest_ip="8.231.120.246"
| stats count min(_time) as first_seen max(_time) as last_seen dc(src_ip) as distinct_hosts values(src_ip) as source_hosts by domain dest_ip
| where count > 0
| sort - count

Microsoft KQL

let RatHatDomains = dynamic(["admin.chunhuating.best","admin.xiongmaocs.pics","admin.rathat.live","dramaspoolcoa.com","rathat.me","mgardownload.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (RatHatDomains) or RemoteIP == "8.231.120.246"
| project Timestamp, DeviceName, DeviceId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count() by DeviceName, DeviceId, RemoteUrl, RemoteIP
| order by Count desc

Sigma

title: RatHat Android MaaS RAT DNS/Proxy Resolution to Known C2 or Distribution Infrastructure
id: 3f6a1d2c-8b4e-4a1f-9d3c-7e2b5f8a01aa
status: experimental
description: Detects DNS resolution or proxy/firewall connections to known RatHat Android banking-trojan console C2 domains, the related PromptSpy distribution domain, or the documented C2 IP, indicating a RatHat/PromptSpy phishing-download or MaaS console beacon.
references:
    - https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html
    - https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/
author: Threadlinqs Team
date: 2026-09-28
tags:
    - attack.initial-access
    - attack.t1660
    - attack.defense-evasion
    - attack.t1655
    - attack.tool.rathat
    - attack.tool.promptspy
logsource:
    category: dns_query
detection:
    selection_domain:
        query|contains:
            - 'admin.chunhuating.best'
            - 'admin.xiongmaocs.pics'
            - 'admin.rathat.live'
            - 'dramaspoolcoa.com'
            - 'rathat.me'
            - 'mgardownload.com'
    condition: selection_domain
falsepositives:
    - None known — these are single-purpose attacker-registered domains with no legitimate use
level: high

Known false positives:

• None expected — these are single-purpose attacker-registered domains/IP with no legitimate business use; verify a threat-intel feed or DNS sinkhole isn't the source of the resolution before escalating

Tuning notes: Add newly observed RatHat/PromptSpy console rebrand domains as the MaaS operators rotate infrastructure (Fisher -> BlackCat -> Panda Workshop V5/V6 shows a roughly monthly rebrand cadence); pivot on AS4907 (Singapore) hosting to catch related un-flagged IPs, and treat any hit as high-priority since these domains have no legitimate use.

• 🔒 RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (KQL) · unlock with TL Creds
• 🔒 Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (KQL) · unlock with TL Creds
• 🔒 RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (KQL) · unlock with TL Creds
• 🔒 RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (Sigma) · unlock with TL Creds
• 🔒 Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (Sigma) · unlock with TL Creds
• 🔒 RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (Sigma) · unlock with TL Creds
• 🔒 Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (SPL) · unlock with TL Creds
• 🔒 RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-09-29, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-2743.

Sample indicators (3 of 32)

• IP address: 8.231.120[.]246
• Domain: admin[.]chunhuating[.]best
• File hash: 116346cace7f00ba557034b534d40791

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Technical analysis

RatHat is distributed as a malware-as-a-service (MaaS) platform: operators rent access to a web console that builds Android banking-trojan APKs and manages infected devices. Cleafy Labs traced the console's lineage from Fisher (in operation December 2025-February 2026, C2 admin.rathat[.]live) through a rebuild branded BlackCat Remote Control Management in April 2026 (C2 IP 8.231.120[.]246), to Panda Workshop V5 in August 2026 (C2 admin.xiongmaocs[.]pics) and Panda Workshop V6 in September 2026 (C2 admin.chunhuating[.]best), documenting nearly 100 separate console deployments across that period consistent with a MaaS model where each customer runs an independent instance.

The malware's infection chain begins with Accessibility-service abuse: once a victim (via SMS smishing, malvertising, or a phishing/fake-app-store download page) grants Accessibility permissions, RatHat uses them to open Settings, enable Developer Options and Wireless Debugging without further prompts, read the six-digit ADB pairing code off the victim's own screen, and connect to the device's local ADB daemon over the loopback interface. This grants shell-level execution (UID 2000) without an attacker-controlled computer, bypassing normal Android runtime consent dialogs to silently grant permissions, disable background restrictions, and enforce persistence. This technique mirrors the wireless-ADB abuse recently documented in the ToxicPanda and RedHook Android RAT families.

The malware consists of three components: a Go-based agent (liblocal-service.so) that executes ADB shell commands, manages persistence, keylogs, and bypasses battery restrictions; an FRP-based reverse-proxy client (libmedia_codec.so) that opens a persistent tunnel back to operator infrastructure; and the main module handling credential theft, SMS interception, and UI automation via HTML overlays impersonating banking and cryptocurrency apps. For screen control, operators deploy a Go program that uses minicap and minitouch (on Android versions below 14) for undetected, permission-prompt-free screen streaming and synthetic taps, falling back to screencap at roughly five frames per second with a visible recording indicator on Android 14+ where minicap/minitouch no longer function without detection. Notably, the Go control program keeps running after the victim uninstalls the visible app, persisting until the device reboots; the two malicious components also mutually reinstall one another if either is removed, and the malware actively intercepts and blocks uninstall-confirmation dialogs.

To evade hash-based antivirus detection, the console can rebuild the distributed APK on a schedule (e.g., hourly), producing a new file hash from the same underlying malware each time. Anti-analysis measures include APK container tampering, an artificially bloated ~61MB AndroidManifest.xml, and invalid DEX pseudo-instructions intended to break static-analysis tooling.

The newest capability, introduced with Panda Workshop V6 in September 2026, has the console call Google's Gemini AI model against the SMS text and fake-overlay-captured credentials harvested from each infected phone to estimate that victim's bank balance, sorting devices into high-value and mid-value buckets so operators can prioritize manual follow-on fraud on the phones most worth their time -- Gemini is used for victim triage, not for automating the theft itself. Separately, RatHat also calls Gemini directly from the infected device at runtime, serializing the live Android Accessibility tree to XML and sending it to the model to determine where to tap when hard-coded UI automation fails across different device manufacturers, OEM skins, and Android versions -- solely to keep the wireless-debugging setup functioning across device diversity. Zimperium's concurrent, overlapping analysis (published September 16, 2026 by researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega) documents the same on-device technique in more general terms: RatHat serializes the Accessibility tree and asks an AI assistant for tap/scroll/read instructions rather than following a hardcoded script, and the researchers attribute the malware to China-nexus operators after finding LLM prompts written in simplified Chinese in the sample set. Zimperium also reports distribution via malvertising, SMS, and phishing sites hosting APKs outside Google Play.

This on-device LLM-driven UI automation technique was first documented in Android malware by ESET in February 2026 in a distinct but related family, PromptSpy (an evolution of VNCSpy, first seen on VirusTotal from Hong Kong on 2026-01-13), which used Gemini prompts plus an XML dump of on-screen UI elements to keep itself pinned in the recent-apps list for persistence, and which also carried simplified-Chinese debug strings and targeted Argentina via a dedicated distribution site (mgardownload[.]com) using a fake JPMorgan Chase ('MorganArg') dropper. Neither Cleafy nor Zimperium disclosed a specific victim count, named targeted banks, or a named threat-actor group for RatHat; the Chinese-language attribution is based on artifact language only.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1629.001 Prevent Application Removal; T1633 Virtualization/Sandbox Evasion; T1655 Masquerading; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Keylogging; T1417.002 GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1426 System Information Discovery

Collection

T1429 Audio Capture; T1512 Video Capture; T1513 Screen Capture; T1517 Access Notifications; T1636.003 Protected User Data: Contact List; T1636.004 SMS Messages

Command and Control

T1437.001 Web Protocols; T1544 Ingress Tool Transfer; T1572 Protocol Tunneling; T1663 Remote Access Software

defense-evasion

T1516 Input Injection

Persistence

T1541 Foreground Persistence; T1577 Compromise Application Executable

Resource Development

T1583.001 Acquire Infrastructure: Domains

Execution

T1623.001 Unix Shell

Privilege Escalation

T1626 Abuse Elevation Control Mechanism

Initial Access

T1660 Phishing

Remediation

Immediate actions

• Block the documented RatHat C2 domains and IP (admin.chunhuating[.]best, admin.xiongmaocs[.]pics, admin.rathat[.]live, 8.231.120[.]246) and download URLs (dramaspoolcoa[.]com/en.html, rathat[.]me) at DNS/perimeter
• Enforce installation from Google Play only; block sideloading of APKs from SMS links, ad redirects, and third-party 'app store' pages
• Audit and restrict which apps hold Accessibility-service permissions on managed Android fleets; alert on newly granted Accessibility access followed by Developer Options / Wireless Debugging being enabled
• For infected devices, uninstall via Safe Mode (third-party apps disabled) and factory-reset if the malware resists removal, then perform a full device reboot to clear any surviving Go-agent processes

Workarounds

• Disable Wireless Debugging (Settings > Developer Options) when not actively used for legitimate development
• Keep Google Play Protect enabled; it provides automatic protection against known RatHat/PromptSpy variants

Longer-term hardening

• Deploy mobile threat defense (MTD) / EDR with behavioral detection for Accessibility-service abuse, wireless ADB pairing activity, and minicap/minitouch-style screen-streaming behavior
• Monitor for hourly-cadence APK hash churn against known malware-family behavioral signatures rather than relying on static hash blocklists
• Implement mobile banking app runtime protections (overlay/anti-screen-capture detection, root/ADB-debug detection) to detect when wireless debugging is active
• Track emerging on-device and console-side LLM API abuse (Gemini, other GenAI APIs) as a detection signal in mobile threat intel feeds

Affected and fixed versions

• Google — Android
  Vulnerable versions: Android < 14 (minicap/minitouch enable undetected screen streaming and synthetic tap injection without permission prompts); Android 14+ (falls back to screencap at ~5 fps with a visible recording indicator; wireless-ADB shell abuse via Accessibility-service still functions)

Timeline

Last updated 2026-09-29 · revalidated 1× · latest source

• 2025-12-01 Fisher-branded RatHat console active (through February 2026), C2 locked-ioc-9, download URL locked-ioc-17/app-release-rat-hat-live.apk; earliest sample hash locked-ioc-5 observed
• 2026-01-13 VNCSpy, the predecessor to the related on-device-LLM Android malware family PromptSpy, first appears on VirusTotal from Hong Kong
• 2026-02-01 February 2026 campaign uses a StripChat-themed decoy app with the Fisher panel (exact day not stated, first of month used).
• 2026-02-10 ESET discloses PromptSpy, the first documented Android malware to call Google Gemini at runtime (for recent-apps persistence), targeting Argentina; RatHat Fisher-era sample locked-ioc-4 also dated to this period
• 2026-04-01 RatHat console rebuilt and rebranded 'BlackCat Remote Control Management'; Cleafy begins tracking console deployments from this point, eventually documenting nearly 100 instances; C2 IP locked-ioc-15 observed
• 2026-05-01 Panda Workshop V5 deployments begin (May-August 2026): TOTP 2FA for operators, an AI balance widget and an API namespace restructure (exact day not stated, first of month used).
• 2026-07-01 RedHook Android malware adds wireless-ADB abuse for computer-free shell access, part of the same technique trend RatHat uses
• 2026-08-01 Panda Workshop V5 console version deployed, C2 locked-ioc-7; ToxicPanda 2.0 separately documented using the same wireless-ADB abuse technique with an expanded 167-command set
• 2026-09-16 Zimperium zLabs (Gianluca Braga, Vishnu Pratapagiri, Fernando Ortega) publishes overlapping RatHat analysis, documenting the three-component infection chain and attributing the malware to China-nexus operators based on simplified-Chinese LLM prompts found in samples
• 2026-09-20 Panda Workshop V6 console deployed with Gemini AI-driven victim bank-balance estimation and high/mid-value triage; C2 locked-ioc-6; sample hash locked-ioc-3; download URL locked-ioc-11/en.html
• 2026-09-28 Cleafy's research is publicly reported by The Hacker News, disclosing nearly 100 documented RatHat console deployments since April 2026 and the Gemini-driven victim-prioritization feature
• 2026-09-29 Infosecurity Magazine and other outlets report the Cleafy findings on the Gemini-assisted victim scoring.

Update history

• 2026-09-29 — RatHat Android Banking Trojan MaaS: Evolving C2 Panel (BlackCat to Panda Workshop) with LLM-Driven Automated Transfers: What changed No severity/exploitability/status change (HIGH / ACTIVE already recorded). The record gains technical depth on the C2 panel and its capabilities. New indicators (11) Indicator values are withheld at this access level.

Sources cited

• PromptSpy ushers in the era of Android threats using GenAI ESET WeLiveSecurity · Vendor report
• ESET Research discovers PromptSpy, the first Android threat to use generative AI eset.com · Vendor report
• New Android malware uses AI to steal bank logins and PINs malwarebytes.com · Blog
• RatHat Android Malware Console Uses Gemini AI to Identify High-Value Victims The Hacker News · News · 2026-09-28
• New RatHat Android malware uses AI to automate device control BleepingComputer · News · 2026-09-16
• RatHat Android Trojan Uses AI for Automation SecurityWeek · News
• New 'RatHat' Android Malware Leverages AI to Steal Financial Data infosecurity-magazine.com · News
• PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence The Hacker News · News
• RedHook Android malware now uses Wireless ADB for shell access BleepingComputer · News
• ToxicPanda Android malware uses VPN permissions to block Google Play BleepingComputer · News

Related threats

• Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)

Previous and next in malware

• Poper Blocker Chrome Extension Spyware: Big Star Labs' 'Featured' Ad Blocker Exfiltrates Browsing History, Screenshots, and AI Chatbot Conversations From Millions Previous report
• Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk) Next report