New Android Malware 'RatHat' Uses AI to Hijack Banking and Crypto Accounts

A new Android malware strain called RatHat is leveraging artificial intelligence to bypass security measures and control infected devices. Discovered by Zimperium’s zLabs, the malware spreads via smishing and malvertising, bypassing Google Play. Once installed, it exploits accessibility permissions and ADB services to escape app sandboxes, deploy Go-based agents, and capture credentials through fake HTML overlays on banking and crypto applications. It also monitors touch inputs to steal PINs and patterns, while employing anti-analysis techniques to evade detection.