RatHat: AI-Powered Android Malware Hijacks Devices via ADB and Accessibility Abuse
A newly identified Android banking trojan, RatHat, leverages artificial intelligence, Accessibility Service abuse, and Android Debug Bridge (ADB) pairing to steal sensitive data, including banking credentials, payment PINs, one-time passwords (OTPs), and lock-screen patterns. The malware spreads through smishing, malicious ads, phishing sites, and third-party app stores, tricking victims into installing APK files disguised as legitimate apps such as streaming services, browsers, or financial applications.
Unlike typical Android malware, RatHat employs a multi-stage infection chain to maintain persistence. After installation, it uses localized HTML lures to convince victims to enable Accessibility Services, then automates the activation of Wireless Debugging by simulating taps on the device’s Build Number setting. Once enabled, the malware extracts the ADB pairing code and port number, allowing it to establish shell-level access via its embedded ADB library without requiring a USB connection.
RatHat deploys two Go-based binaries to sustain its attack:
- liblocal-service.so: A privileged local agent running from
/data/local/tmp. - libmedia_codec.so: A Fast Reverse Proxy client that creates a persistent tunnel to the attacker’s command-and-control (C2) server.
The malware also incorporates AI-driven UI automation, serializing the device’s Accessibility tree into XML and sending it to a generative AI assistant. This enables real-time adaptation, allowing RatHat to identify screen coordinates, extract visible text, and execute dynamic navigation actions such as scrolling rather than relying on static scripts.
Once active, RatHat targets banking, cryptocurrency, payment, and messaging apps with fake HTML overlays, capturing usernames, passwords, card details, and PINs. It intercepts SMS messages and notifications to steal OTPs and two-factor authentication codes, while an Accessibility-based keylogger logs text inputs including masked password fields. The malware also monitors browser URLs across Chrome, Brave, Opera, Edge, DuckDuckGo, and Samsung Internet, and uses the getevent tool to track raw touch data, reconstructing PINs and unlock patterns from stored keypad layouts.
Security researchers at Zimperium have identified indicators of compromise (IOCs), including the native payloads liblocal-service.so and libmedia_codec.so, though C2 domains and IP addresses remain defanged to prevent accidental resolution. The malware’s AI-assisted automation and ADB-based persistence mark a significant evolution in Android banking trojans, enabling stealthier, more adaptive attacks on financial and personal data.
Source: https://cyberpress.org/rathat-steals-banking-otps/
Samsung Internet TPRM report: https://www.rankiteo.com/company/samsungknox
Opera TPRM report: https://www.rankiteo.com/company/operation-smile
"id": "opesam1789633661",
"linkid": "operation-smile, samsungknox",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': ['Banking',
'Cryptocurrency',
'Payment Services',
'Messaging'],
'type': 'Individual Users'}],
'attack_vector': ['Smishing',
'Malicious Ads',
'Phishing Sites',
'Third-Party App Stores'],
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': ['Banking Credentials',
'Payment PINs',
'OTPs',
'Lock-Screen '
'Patterns'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Banking Credentials',
'Payment PINs',
'OTPs',
'Lock-Screen Patterns',
'SMS Messages',
'Notifications',
'Browser URLs',
'Keystrokes']},
'description': 'A newly identified Android banking trojan, RatHat, leverages '
'artificial intelligence, Accessibility Service abuse, and '
'Android Debug Bridge (ADB) pairing to steal sensitive data, '
'including banking credentials, payment PINs, one-time '
'passwords (OTPs), and lock-screen patterns. The malware '
'spreads through smishing, malicious ads, phishing sites, and '
'third-party app stores, tricking victims into installing APK '
'files disguised as legitimate apps such as streaming '
'services, browsers, or financial applications.',
'impact': {'data_compromised': ['Banking Credentials',
'Payment PINs',
'One-Time Passwords (OTPs)',
'Lock-Screen Patterns',
'SMS Messages',
'Notifications',
'Browser URLs',
'Keystrokes'],
'identity_theft_risk': 'High',
'operational_impact': 'Device Hijacking, Persistent Remote Access',
'payment_information_risk': 'High',
'systems_affected': ['Android Devices']},
'initial_access_broker': {'backdoors_established': ['ADB Shell Access',
'Fast Reverse Proxy '
'Client'],
'entry_point': ['Smishing',
'Malicious Ads',
'Phishing Sites',
'Third-Party App Stores'],
'high_value_targets': ['Banking Apps',
'Cryptocurrency Apps',
'Payment Apps',
'Messaging Apps']},
'investigation_status': 'Ongoing',
'lessons_learned': "The malware's use of AI-driven UI automation and "
'ADB-based persistence represents a significant evolution '
'in Android banking trojans, enabling stealthier and more '
'adaptive attacks on financial and personal data.',
'motivation': ['Financial Gain', 'Data Theft'],
'post_incident_analysis': {'corrective_actions': ['Enhanced detection of '
'ADB-based attacks',
'Improved Accessibility '
'Service monitoring',
'AI-driven threat detection '
'for dynamic malware '
'behavior'],
'root_causes': ['Accessibility Service Abuse',
'ADB Pairing Exploitation',
'AI-Driven UI Automation']},
'recommendations': ['Avoid installing APKs from untrusted sources',
'Disable Accessibility Services for unknown apps',
'Disable Wireless Debugging when not in use',
'Monitor device for unusual ADB connections',
'Use official app stores for downloads'],
'references': [{'source': 'Zimperium'}],
'response': {'third_party_assistance': 'Zimperium (Security Researchers)'},
'title': 'RatHat: AI-Powered Android Malware Hijacks Devices via ADB and '
'Accessibility Abuse',
'type': 'Malware (Banking Trojan)',
'vulnerability_exploited': ['Accessibility Service Abuse',
'Android Debug Bridge (ADB) Pairing']}