RatHat Android credential-theft malware
Malware Activity
Summary
Hide ▲
Show ▼
RatHat is an Android malware activity that Zimperium linked to China-based threat actors and that targets banking credentials, 2FA/OTP data, notifications, and screen and input capture. It spreads through smishing, malvertising, deceptive download portals, third-party forums, and malicious APKs, then uses a dropper, Accessibility abuse, and local ADB self-pairing to break out of the sandbox and gain shell-level privileges. Cleafy later reported that RatHat's C2 panels were rebranded from BlackCat to Panda Workshop, could build, sign, publish, and regenerate samples, and used Gemini to rank victims while campaigns ran across Europe, Latin America and Southeast Asia. Cleafy also observed nearly 100 deployments since April 2026, consistent with a MaaS model, while the malware retained persistence, a hardware-level keylogger, and AI-assisted UI automation.
Related Happenings
Corp MDM Android spyware targeting logistics firms
Malware Activity
H score19
First: 24.09.2026 15:05
Last: 24.09.2026 15:05
Sources 1
About this happening:
The Corp MDM Android spyware operation is targeting the logistics sector with fake Google Play pages that deliver an APK designed to steal new SMS, divert calls, a...
Corp MDM Android spyware targeting logistics firms
Malware ActivityAbout this happening: The Corp MDM Android spyware operation is targeting the logistics sector with fake Google Play pages that deliver an APK designed to steal new SMS, divert calls, a...
RatHat Android malware analysis with AI-assisted UI automation and anti-analysis layers
Technical Analysis
H score26
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
The infrastructure behind the RatHat Android banking trojan has changed more than the malware itself, with successive command-and-control (C2) panels able to build malware, manage infected devices and use AI to rank potential victims.
About this happening:
RatHat is an Android banking trojan whose C2 panels changed more than the implant itself, with Cleafy reporting a rebrand from BlackCat to Panda Workshop a...
RatHat Android malware analysis with AI-assisted UI automation and anti-analysis layers
Technical AnalysisHow related: The infrastructure behind the RatHat Android banking trojan has changed more than the malware itself, with successive command-and-control (C2) panels able to build malware, manage infected devices and use AI to rank potential victims.
About this happening: RatHat is an Android banking trojan whose C2 panels changed more than the implant itself, with Cleafy reporting a rebrand from BlackCat to Panda Workshop a...
RatHat smishing-malvertising Android APK distribution campaign
Campaign
H score36
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening:
RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
RatHat smishing-malvertising Android APK distribution campaign
CampaignHow related: RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening: RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
Mantax Otax Android malware activity
Malware Activity
H score32
First: 11.09.2026 00:40
Last: 11.09.2026 00:40
Sources 1
About this happening:
The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Mantax Otax Android malware activity
Malware ActivityAbout this happening: The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware Activity
H score19
First: 10.09.2026 17:36
Last: 10.09.2026 17:36
Sources 1
About this happening:
The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware ActivityAbout this happening: The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
Timeline
-
29.09.2026 17:30 1 articles · 1d ago
RatHat C2 panels evolve into a MaaS operation
Campaign Scope UpdateCleafy reported that RatHat's command-and-control panels were rebranded from BlackCat to Panda Workshop, went through three generations in six months, and could build, sign, publish, and regenerate Android samples from the operator console. The latest panel added 2FA, a phishing download-page builder, role-based access, and Gemini-based victim scoring, while nearly 100 deployments since April 2026 across Europe, Latin America and Southeast Asia pointed to a malware-as-a-service model.
Show sources
- RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model — www.infosecurity-magazine.com — 29.09.2026 17:30
-
18.09.2026 09:17 1 articles · 13d ago
RatHat uses AI-assisted ADB self-pairing for shell access
Technical Analysis UpdateZimperium said RatHat pairs Accessibility abuse with autonomous local ADB (Android Debug Bridge) self-pairing to break out of the Android sandbox, unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code. The malware stages native daemons that execute with shell-level privileges, lets a Go Agent masquerading as liblocal-service.so apply persistence and power management exemptions, and can re-install itself through the local service after uninstall. The operator also uses an FRP reverse-proxy client to establish a persistent reverse tunnel to the C2 server, while the malware can record finger presses on screen with a hardware-level keylogger.
Show sources
- RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall — thehackernews.com — 18.09.2026 09:17
-
17.09.2026 16:00 2 articles · 13d ago
Zimperium identifies RatHat Android malware stealing banking credentials
Initial DisclosureZimperium's zLabs team identified RatHat, a new Android malware strain linked to China-based threat actors, and found it targets banking credentials, notifications, 2FA/OTP data, and screen and input capture. The malware is distributed through deceptive phishing sites, malvertising, SMS phishing, third-party forums, and malicious APKs, then uses a dropper with two encrypted assets, native SessionInstaller APIs, multiple anti-analysis layers, and an anti-debug layer; it also serializes the device's live Accessibility tree to XML and uses a generative AI assistant for UI automation.
Show sources
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00