RatHat Android Malware Sends the Screen to an AI Assistant to Find Its Way Into Wireless Debugging

Android users, lured by malvertising, SMS, and phishing sites to sideloaded APKs

Zimperium zLabs reported RatHat, a remote access trojan that serializes Android's Accessibility tree into XML and sends it to a popular AI assistant, unnamed in the report, which returns the coordinates of interface elements, the on-screen text, and navigation instructions such as `SCROLL_DOWN`. With that guidance the malware turns on Developer Options and Wireless Debugging to gain local shell-level execution, then deploys two Go agents for command execution, persistence, and FRP reverse proxying. It overlays banking and cryptocurrency apps, intercepts SMS and notifications including one-time passwords, captures lock-screen credentials, logs keystrokes, and blocks uninstallation with fake Google Play errors. Zimperium links it to Chinese-speaking operators through LLM prompts written in Chinese. No infected apps were found on Google Play

Accessibility permission plus a general-purpose model that can read any screen layout, which replaces the device-specific UI automation that used to limit this kind of malware