A newly identified Android trojan, RatHat, is leveraging generative AI to enhance its control over compromised devices, according to mobile security company Zimperium.
Advanced Threat Mechanism
RatHat is disseminated via smishing and malvertising, utilizing an automated multi-phase infection process. This approach enables it to bypass Android’s application sandbox, allowing shell-level execution.
The malware exhibits common capabilities found in mobile threats, such as stealing credentials and mimicking financial apps to extract sensitive information. It also creates a covert communication line with its command-and-control (C&C) server for remote operations.
AI-Powered Device Manipulation
What sets RatHat apart is its use of generative AI to navigate device interfaces in real-time. The malware monitors user input at the hardware level to decode PINs, passwords, and access patterns. It escalates its privileges by granting itself administrator permissions, installs a hidden service to maintain persistence, and reinstalls itself if removed.
Analysis of AI prompts indicates potential development by a Chinese threat actor. The malware is introduced through a dropper with encrypted assets, exploiting native APIs to circumvent security measures.
Structural Components and Capabilities
RatHat’s architecture comprises a malicious Android app, a Go-based agent, and an FRP client. These elements collaborate to gain critical system permissions, initiate the infection chain, and interface with users through dynamic configurations.
To elevate privileges, the malware employs a localized HTML lure for accessing Accessibility Services, exploits an advanced WebView overlay to simulate interfaces of popular applications, and intercepts SMS messages. It also requests Device Admin rights to execute destructive actions.
A unique aspect of RatHat is its interaction with a generative AI assistant, which automatically navigates the device by interpreting on-screen content. This AI-driven mechanism facilitates non-malicious operations by serializing the device’s Accessibility tree to XML.
Persistence and Data Gathering
Upon securing a shell via the local ADB daemon, RatHat deploys a Go agent that acts as the C&C core, executing directives and ensuring system persistence with power management exemptions.
The malware’s third component, derived from fatedier/frp, is a reverse-proxy client that creates a steadfast reverse tunnel to the ADB daemon, enabling command execution by attackers.
RatHat is equipped to intercept and thwart uninstallation attempts. If removed, its shell service persists, periodically checking and reinstalling the application as needed.
Keylogging is achieved through three specialized methods: monitoring accessibility text-change events to reconstruct user input, reading browser address bars, and recording touch coordinates at the hardware level using Android’s debugging tools.
Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews.
