New Android malware uses AI to steal bank logins and PINs

Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process.

What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script.

The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan.

It also abuses Android Debug Bridge (ADB), a legitimate tool that lets a computer communicate with an Android device. By turning on Wireless Debugging, RatHat can escape the normal app sandbox.

The attack

The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline.

• Victims are lured through smishing (SMS phishing) texts and malicious ads that lead to fake download pages, sometimes disguised as a popular streaming app or even a browser like Chrome. These pages trick people into sideloading a malicious APK (Android Package Kit).
• Once installed, the app pressures the user into enabling Android’s Accessibility Service, using a fake “network restriction” excuse or bogus financial incentive. Accessibility services run in the background and can inspect screen content and interact with apps on the user’s behalf.
• With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device without a person or computer to complete the process. This is a known, legitimate Android feature (normally used by app developers to test on a phone over Wi-Fi) that RatHat repurposes for self-escalation.

Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process.

What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script.

The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan.

It also abuses Android Debug Bridge (ADB), a legitimate tool that lets a computer communicate with an Android device. By turning on Wireless Debugging, RatHat can escape the normal app sandbox.

The attack

The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline.

• Victims are lured through smishing (SMS phishing) texts and malicious ads that lead to fake download pages, sometimes disguised as a popular streaming app or even a browser like Chrome. These pages trick people into sideloading a malicious APK (Android Package Kit).
• Once installed, the app pressures the user into enabling Android’s Accessibility Service, using a fake “network restriction” excuse or bogus financial incentive. Accessibility services run in the background and can inspect screen content and interact with apps on the user’s behalf.
• With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device without a person or computer to complete the process.