RatHat Android RAT: defender checklist for MSP mobile fleets

RatHat Android RAT: defender checklist for MSP mobile fleets

Defender reporting describes RatHat as an Android remote-access class that uses AI-assisted UI navigation and social-engineering delivery. There is no single magic patch CVE for “turn off RatHat.” MSP value is fleet hygiene: block sideload paths, tighten Accessibility allowlists, and pipe MTD signals into SIEM.

Defender guide (secondary): Security Arsenal · RatHat defender guide.

MSP checklist (defensive):

• Block sideload / unknown sources on work profiles
• Accessibility services: allowlist only approved apps
• Disable unauthorized ADB / developer options on managed devices
• MTD / EMM alerts → SIEM with owner + ticket SLA
• User coaching: no “remote support” APKs outside your RMM

Ban: no malware unpack, no bypass tips, no C2 recipes, no exploit/PoC. Detection and response hygiene only.

Draft only — do not publish without editorial review.