RatHat Android malware analysis with AI-assisted UI automation and anti-analysis layers
Technical Analysis
Summary
Hide ▲
Show ▼
RatHat is an Android banking trojan whose C2 panels changed more than the implant itself, with Cleafy reporting a rebrand from BlackCat to Panda Workshop and panel features to build, sign, publish, and regenerate malware. The latest panel used Gemini to rank victims by bank balance and guide taps on unfamiliar Android screens, while campaigns ran across Europe, Latin America and Southeast Asia and the MaaS activity included nearly 100 deployments since April 2026. Cleafy also said operators could use wireless debugging to launch a Go service with shell-level control that can persist until reboot, even if the malicious app is removed.
Related Happenings
RatHat Android credential-theft malware
Malware Activity
H score27
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.
About this happening:
RatHat is an Android malware activity that Zimperium linked to China-based threat actors and that targets banking credentials, 2FA/OTP data, notifications,...
RatHat Android credential-theft malware
Malware ActivityHow related: Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.
About this happening: RatHat is an Android malware activity that Zimperium linked to China-based threat actors and that targets banking credentials, 2FA/OTP data, notifications,...
Latest development: 29.09.2026 17:30
Cleafy reported that RatHat's command-and-control panels were rebranded from BlackCat to Panda Workshop, went through three generations in six months, and could build, sign, publish, and regenerate Android samples from the operator console. The latest panel added 2FA, a phishing download-page builder, role-based access, and Gemini-based victim scoring, while nearly 100 deployments since April 2026 across Europe, Latin America and Southeast Asia pointed to a malware-as-a-service model.
RatHat smishing-malvertising Android APK distribution campaign
Campaign
H score36
First: 17.09.2026 16:00
Last: 17.09.2026 16:00
Sources 1
How related:
RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening:
RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
RatHat smishing-malvertising Android APK distribution campaign
CampaignHow related: RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, SMS phishing (smishing) campaigns and third-party forums.
About this happening: RatHat is a newly disclosed Android malware campaign linked to China-based threat actors that spreads through malvertising, SMS phishing, and deceptive phishin...
Mantax Otax Android malware activity
Malware Activity
H score32
First: 11.09.2026 00:40
Last: 11.09.2026 00:40
Sources 1
About this happening:
The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Mantax Otax Android malware activity
Malware ActivityAbout this happening: The Mantax Otax Android malware now combines ransomware and spyware features, putting older Android devices at risk of file encryption, data theft, and harassment....
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware Activity
H score19
First: 10.09.2026 17:36
Last: 10.09.2026 17:36
Sources 1
About this happening:
The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
Hagaseca Android RAT spread via THost9 loader and ADB worm behavior
Malware ActivityAbout this happening: The Hagaseca Android remote access trojan is being spread through the THost9 loader and a worm component that scans exposed ADB services, enabling persistent device co...
MantaxOtax Android malware with ransomware and spyware control
Malware Activity
H score32
First: 10.09.2026 16:00
Last: 10.09.2026 16:00
Sources 1
About this happening:
The MantaxOtax Android malware now combines file encryption with spyware-style surveillance, putting infected phones at risk of both lockout and data theft. It can ste...
MantaxOtax Android malware with ransomware and spyware control
Malware ActivityAbout this happening: The MantaxOtax Android malware now combines file encryption with spyware-style surveillance, putting infected phones at risk of both lockout and data theft. It can ste...
Timeline
-
17.09.2026 16:00 6 articles · 13d ago
Zimperium analyzes RatHat Android malware with AI-assisted UI automation
Technical Analysis UpdateZimperium’s zLabs identified RatHat, a new Android malware strain linked to China-based threat actors that steals banking credentials, notifications, 2FA/OTP data, and screen or input content. The sample uses a generative AI user interface-automation engine, serializes the target device’s live Accessibility tree to XML, and appears to use Google’s Gemini AI models for operator-controlled navigation and clicks while relying on four anti-analysis layers and one anti-debug layer, plus a dropper with two encrypted assets and SessionInstaller API abuse.
Show sources
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00
- New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data — www.infosecurity-magazine.com — 17.09.2026 16:00
- New RatHat Android malware uses AI to automate device control — www.bleepingcomputer.com — 18.09.2026 00:50
- RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall — thehackernews.com — 18.09.2026 09:17
- RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims — thehackernews.com — 28.09.2026 20:38
- RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model — www.infosecurity-magazine.com — 29.09.2026 17:30