RatHat: an AI-piloted Android RAT that reads the screen to find its way around

Zimperium's zLabs researchers have published details on RatHat, an Android remote-access trojan that uses generative AI to decide how to navigate an infected device. Instead of running a fixed script, RatHat feeds a live snapshot of the device's on-screen elements to an AI model, which tells it where to tap next -- behavior the researchers say is harder for security software to catch than traditional automated malware. Zimperium says language patterns in the malware's prompts point to Chinese-language origins.

How it spreads and operates

RatHat reaches victims through malvertising, SMS and phishing sites that push APK downloads from outside Google Play. Once installed, it abuses Android's Accessibility services to enable wireless debugging and link to the Android Debug Bridge, which lets it escape normal app sandboxing and run commands with elevated permissions. From there it can read raw touchscreen input to infer PINs and passwords, and it overlays fake banking, payment and crypto-wallet screens to capture credentials and one-time codes. Zimperium says the malware primarily targets financial apps such as WeChat Pay and Alipay alongside other regional services, and has tied 162 infected apps to roughly a dozen operator-controlled servers.

Why it resists removal

RatHat runs a hidden service independent of the visible app, letting it reinstall itself and regain permissions after a user tries to remove it. It also actively fights uninstallation: it intercepts the system's uninstall confirmation and shows a fake Google Play error to make the removal appear to have failed. Zimperium also documents several anti-analysis techniques -- a deliberately bloated manifest and malformed code structures -- designed to slow down researchers and automated scanners.

What MSPs can do

• Block sideloading and unknown app sources on managed work profiles.
• Allowlist Accessibility services to approved apps only, and alert on new requests.
• Disable unauthorized ADB or developer-options access on managed devices.
• Route mobile threat defense and EMM alerts into your SIEM with a named owner and SLA.
• Tell users that legitimate remote support only comes through your own RMM channel, never a downloaded APK.

There is no single patch for RatHat -- it is a detection and hygiene problem, not a CVE. If a managed device resists a normal removal attempt, disconnect it from sensitive accounts and networks before trying again, rather than assuming a second wipe will succeed where the first did not.

Sources: BleepingComputer, Zimperium research summary.