New RatHat Android Malware Leverages AI for Real-Time Device Control
Security researchers at Zimperium zLabs discovered RatHat, a novel Android trojan that integrates generative AI to analyze UI layout XML files from infected devices in real time. The malware sends captured screen layouts to an AI model to obtain element coordinates and automated navigation commands (such as SCROLL_DOWN) for attackers. RatHat represents a shift in mobile threat tactics by replacing rigid script-based automation with generative AI models to dynamically navigate victim interfaces. This reduces the effort required for attackers to bypass security screens, capture credentials, and maintain remote control over infected smartphones. RatHat abuses Android Accessibility Services to log text events, intercept SMS notifications, steal unlock credentials, and prevent uninstallation by displaying spoofed error prompts. To thwart security researchers, it employs heavy anti-analysis techniques, including a bloated 61MB Android Manifest file, APK container tampering, and invalid DEX pseudo-instructions.
## BACKGROUND
Android Accessibility Services are designed to help users with disabilities interact with apps by reading screen content and executing gestures, but malware frequently abuses these high-risk permissions to achieve full remote automation without root access. Android DEX (Dalvik Executable) files store compiled application code, and attackers often modify these files or APK containers with invalid instructions to break reverse-engineering tools and static malware scanners.