New Android Banking Malware RatHat Exploits Wireless Debugging for Persistent Device Control
A newly discovered Android banking malware, RatHat, is leveraging advanced techniques including Accessibility abuse, local ADB pairing, and generative AI-assisted automation to steal sensitive financial data from infected devices. Linked to China-based threat actors, the malware targets banking credentials, payment PINs, OTPs, device unlock patterns, and high-value personal data.
Infection Chain & Key Capabilities
RatHat spreads via smishing, malicious ads, third-party forums, and fake app portals, tricking users into sideloading APKs disguised as legitimate apps such as a well-known streaming service or Chrome. Once installed, it abuses Android’s Accessibility Service to:
- Unlock Developer Options and enable Wireless Debugging via synthetic taps.
- Scrape the ADB pairing code from the screen and pair with the device’s local ADB daemon, granting shell-level access without a connected host.
- Deploy two masqueraded Go binaries in
/data/local/tmp:liblocal-service.so– Bypasses Doze restrictions, grants permissions, and disables security apps.libmedia_codec.so– A Fast Reverse Proxy (FRP) client that creates a persistent reverse tunnel, exposing internal device services to attackers while bypassing NAT/firewalls.
Advanced Credential Theft & Anti-Analysis Measures
RatHat employs raw-input capture by invoking Android’s getevent utility to monitor /dev/input events, logging touch coordinates and timestamps a method typically restricted to privileged processes. By referencing locateValues.json (containing keypad/pattern layouts for major brands), it converts coordinates into PINs, passwords, or unlock patterns, evading protections like screenshot restrictions and custom keyboards.
Additional theft methods include:
- Accessibility event logging (text changes, browser URLs).
- WebView overlays mimicking banking, crypto, and payment apps (e.g., WeChat, Alipay).
- SMS/notification interception for OTPs and 2FA codes.
- Generative AI integration serializing the Accessibility tree into XML and querying an AI assistant to dynamically extract on-screen data or navigate interfaces, reducing reliance on hardcoded scripts.
Persistence & Evasion
To resist removal, RatHat:
- Intercepts uninstall attempts with fake Google Play error overlays.
- Reinstalls itself if deleted, using its shell-level agent to restore permissions and Accessibility settings.
- Implements multi-layered anti-analysis techniques, including:
- Malformed DEX instructions to disrupt disassembly.
- Obfuscated strings and 61 MB Android manifests with undocumented chunks.
- Runtime checks for debuggers (JDWP, Frida, Xposed), emulators, root artifacts, and repackaging.
Command & Control (C2) Infrastructure
RatHat maintains two C2 channels:
- HTTP/WebSocket – Used by the Android app for data exfiltration and command processing.
- Local HTTP service (127.0.0.1:7910) – Managed by the Go agent for reverse tunneling, screen monitoring, file transfers, and component updates.
Impact & Threat Model
RatHat demonstrates a shift in mobile malware tactics, achieving persistent device control without kernel exploits by chaining:
- Sideloaded APKs → Accessibility abuse → Wireless Debugging → Local ADB pairing → Reverse tunneling.
This approach enables durable access beyond traditional overlay fraud, posing significant risks to banking, MFA, and corporate devices.
Security firm Zimperium first documented the malware, highlighting its targeted financial fraud operations and sophisticated evasion techniques.
Source: https://gbhackers.com/rathat-malware-attack/
Alipay TPRM report: https://www.rankiteo.com/company/antgroup
"id": "ant1789633433",
"linkid": "antgroup",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Banking, Financial Services, '
'Cryptocurrency, Payment Apps',
'type': 'Mobile Users'}],
'attack_vector': ['Smishing',
'Malicious Ads',
'Third-Party Forums',
'Fake App Portals'],
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Banking Credentials',
'Payment PINs',
'OTPs',
'Device Unlock Patterns',
'High-Value Personal Data']},
'description': 'A newly discovered Android banking malware, RatHat, is '
'leveraging advanced techniques including Accessibility abuse, '
'local ADB pairing, and generative AI-assisted automation to '
'steal sensitive financial data from infected devices. The '
'malware targets banking credentials, payment PINs, OTPs, '
'device unlock patterns, and high-value personal data.',
'impact': {'data_compromised': ['Banking Credentials',
'Payment PINs',
'OTPs',
'Device Unlock Patterns',
'High-Value Personal Data'],
'identity_theft_risk': 'High',
'payment_information_risk': 'High',
'systems_affected': 'Android Devices'},
'initial_access_broker': {'backdoors_established': ['Wireless Debugging',
'ADB Pairing',
'Reverse Tunneling'],
'entry_point': ['Smishing',
'Malicious Ads',
'Third-Party Forums',
'Fake App Portals'],
'high_value_targets': ['Banking Apps',
'Crypto Apps',
'Payment Apps (WeChat, '
'Alipay)']},
'lessons_learned': 'RatHat demonstrates a shift in mobile malware tactics, '
'achieving persistent device control without kernel '
'exploits by chaining sideloaded APKs, Accessibility '
'abuse, Wireless Debugging, local ADB pairing, and reverse '
'tunneling.',
'motivation': 'Financial Fraud',
'post_incident_analysis': {'root_causes': ['Accessibility Service Abuse',
'Wireless Debugging Exploitation',
'ADB Pairing',
'Reverse Tunneling']},
'references': [{'source': 'Zimperium'}],
'response': {'third_party_assistance': 'Zimperium'},
'threat_actor': 'China-based threat actors',
'title': 'New Android Banking Malware RatHat Exploits Wireless Debugging for '
'Persistent Device Control',
'type': 'Banking Malware',
'vulnerability_exploited': ['Accessibility Service Abuse',
'Wireless Debugging',
'ADB Pairing']}