RatHat Android Malware Uses Generative AI to Steal Credentials

Cybersecurity researchers at Zimperium have identified a sophisticated new Android malware strain dubbed RatHat. Unlike traditional malware that relies on static scripts, RatHat leverages generative AI to navigate infected devices in real-time, allowing it to intelligently interact with the accessibility tree to bypass security measures. The malware typically infiltrates devices via social engineering, often masquerading as legitimate applications like Google Chrome through fake app stores. Once granted accessibility permissions, RatHat activates wireless debugging to capture sensitive data, including passwords, text messages, and multi-factor authentication codes. It also functions as a keylogger by recording raw touch inputs. Because the malware embeds itself deeply into the system, experts warn that a factory reset is the only effective method for removal. Users are strongly advised to avoid downloading applications from untrustworthy sources to mitigate the risk of infection.