The Pulse
RatHat Uses AI and ADB to Hijack Android Phones
Zimperium’s zLabs describes RatHat, an Android threat that combines Accessibility abuse, local ADB pairing and generative-AI interface control to steal credentials and maintain access to infected devices.
AI.info Team ·
Zimperium’s zLabs research team has identified RatHat, an Android Trojan that uses generative AI to operate infected phones while stealing bank credentials, one-time passwords, PINs and unlock patterns. The malware combines Accessibility Service abuse with Android Debug Bridge self-pairing, giving it shell-level access without requiring a computer connected to the device.
Zimperium published its technical analysis on September 16, 2026. The researchers say the threat actors appear to be operating in China, an assessment rather than a confirmed attribution.
“RatHat incorporates novel techniques for persistence and leverage generative AI for operational control.”
Gianluca Braga, Vishnu Pratapagiri and Fernando Ortega, the authors of the Zimperium analysis, describe the malware as a multi-stage threat distributed through deceptive phishing sites, malvertising campaigns and smishing.
RatHat Turns Accessibility Data Into Screen Commands
RatHat’s most unusual feature is an automated interface-control system that sends the infected phone’s live Accessibility tree to a generative AI assistant. The malware asks the service to identify visible text, resolve the coordinates of named interface elements and issue navigation instructions such as scrolling down.
That approach differs from conventional mobile malware that follows a fixed sequence of taps. RatHat can adapt its actions to the current screen, which may make the attack less predictable for security tools built around known scripts and static indicators. Zimperium describes the system as a real-time decision loop rather than a set of hardcoded gestures.
Wireless Debugging Gives the Trojan a Shell
The attack begins with smishing, malicious advertising or third-party download sites that promote a fake application. Zimperium found samples disguised as a streaming service and configured to present other labels, including “Chrome.” The victim must manually install the APK and then approve Accessibility Service access after being shown a false explanation involving network restrictions or a financial incentive.
Once granted that access, RatHat opens Android’s Developer Options, enables Wireless Debugging and reads the six-digit ADB pairing code from the screen. The malware then pairs with the phone’s own ADB service through an embedded library, without a host computer completing the process.
That local pairing gives the malware access to the /data/local/tmp directory and a shell context. RatHat uses it to install two disguised native components: a Go-based agent named liblocal-service.so and a reverse-proxy client hidden behind the name libmedia_codec.so. The first executes system commands; the second creates a persistent tunnel to the operator’s server.
Raw Touch Data Helps Capture Credentials
RatHat also reads raw touch events from Android’s input device interface. Zimperium says the Go-based agent can record where a finger touches the screen, giving the operator access to input data that ordinary applications cannot read.
The same samples use HTML overlays to imitate banking and payment applications. The overlays collect usernames, passwords, PINs and other form data, while Accessibility and notification capabilities allow the malware to intercept SMS messages and two-factor authentication codes. Zimperium says the malware targets banking and payment applications.
Uninstalling the App May Not Remove RatHat
RatHat separates part of its operation from the visible Android application. Its local service runs outside the normal application lifecycle, allowing it to remain after the main package is removed. The service checks whether the APK is still installed and can reinstall it, restore runtime permissions and re-enable Accessibility settings through shell commands.
The research also describes an overlay that makes an uninstall attempt appear to fail. The malware can request device-administrator access, disable selected packages and add itself to Android’s power-management allowlist so that background execution continues.
Zimperium found four anti-analysis layers, including a 61-megabyte Android manifest designed to disrupt inspection tools, malformed DEX instructions and multiple string-encryption systems. The payload also checks for debuggers, Frida, Xposed, root indicators and emulators before proceeding.
What Android Users Should Check
RatHat’s delivery chain depends on two decisions from the victim: installing an APK outside a trusted store and granting an unrelated app Accessibility access. Android users should avoid app downloads promoted through text messages, advertisements and unofficial sites, particularly when the installation instructions ask for Accessibility Service, Developer Options or Wireless Debugging.
Users who suspect an infection should disconnect the device from sensitive accounts and seek professional assistance before changing passwords on the phone. Because RatHat can maintain a separate local service after the visible app is removed, ordinary app removal may not eliminate the threat.
The research shows how a permission intended to help people interact with phones can become a bridge to developer controls, shell access and financial theft when a user grants it to a deceptive APK.