RatHat Android Trojan Uses Generative AI for Device Takeover

Executive Summary

Mobile threat researchers at Zimperium zLabs have uncovered RatHat, an unprecedented Android Remote Access Trojan (RAT) that integrates generative AI (LLMs) to dynamically navigate compromised devices and automate credential theft. Unlike conventional mobile banking malware that relies on brittle, hardcoded UI coordinates or static scripts, RatHat parses real-time accessibility node trees through an external AI engine, allowing it to adapt effortlessly across diverse device resolutions, Android versions, and localized app interfaces.

Beyond its AI-driven interface automation, RatHat breaks out of the standard Android application sandbox by executing an autonomous local Android Debug Bridge (ADB) self-pairing sequence over Wireless Debugging. Once elevated to native shell privileges (UID 2000), the malware deploys compiled Go binaries—including a persistent system management daemon and a Fast Reverse Proxy (FRP) client—allowing remote operators to execute shell commands, sniff raw kernel touch coordinates from /dev/input/event*, and maintain indestructible persistence that silently reinstalls the application if deleted by the user.

Technical Vulnerability Analysis & Attack Chain

The RatHat infection workflow represents a major evolution in mobile malware engineering, combining social engineering, accessibility exploitation, autonomous local privilege escalation, and generative AI execution:

[Smishing / Malvertising Lure]

│

▼

[Malicious APK Installation] ──► Solicits Accessibility Services (svc_config.html)

│

▼

[Autonomous ADB Self-Pairing] ──► Wireless Debugging via Local Loopback (127.0.0.1)

│

▼ (Shell UID 2000 Elevation)

[Staging Native Go Daemons in /data/local/tmp]

│ │

├──► liblocal-service.so └──► libmedia_codec.so (frpc)

│ (Permissions, Battery Doze, (Encrypted C2 Reverse Tunnel)

│ Auto-Reinstall Watchdog)

▼

[Generative AI Dynamic UI Engine]

│

├──► Serializes Accessibility Tree to XML/JSON

├──► AI LLM Model Identifies Target Buttons & Fields

└──► Reconstructs PINs/Patterns via Kernel /dev/input/event*

1. Delivery and Accessibility Abuse

Victims are lured via targeted SMS phishing (smishing) messages regarding package deliveries, banking alerts, or utility billing, directing them to fraudulent landing portals distributing rogue APKs. Upon installation, the malware displays localized WebView prompts (svc_config.html) that aggressively coerce victims into enabling Android's Accessibility Service.

Once granted, RatHat leverages its accessibility hooks to suppress security dialogs, dismiss system warnings, and grant itself runtime permissions without user intervention.

2. Autonomous Local ADB Self-Pairing & Sandbox Escape

On Android 11 and later, Google introduced Wireless Debugging, allowing developers to connect to ADB over Wi-Fi using an ephemeral pairing code and dynamic port. RatHat weaponizes this mechanism entirely on-device without requiring a physical USB connection to a computer:

1. Automated Navigation: The malware abuses Accessibility Services to navigate the user's Settings menu, toggling Developer Options and enabling Wireless Debugging.
2. Pairing Code Interception: When Android prompts the 6-digit wireless pairing dialog, RatHat's accessibility service inspects the UI node tree, scrapes the pairing code, and reads the assigned local TCP port.
3. Local Loopback Handshake: RatHat executes an embedded ADB client routine to pair directly with 127.0.0.1:<pairing_port>.
4. Sandbox Escape: Once paired, the malware establishes an active ADB session, gaining native shell privileges (UID 2000), entirely bypassing Android application sandbox constraints.

3. Native Go Daemons and FRP Reverse Tunneling

Operating under the shell context, RatHat drops and executes two masqueraded 64-bit Go binaries into /data/local/tmp:

• `liblocal-service.so` (Privileged Management Agent):
  • Executes privileged ADB shell commands: pm grant <pkg> <permission> to assign high-privilege permissions silently.
  • Bypasses Android battery optimizations by modifying Doze mode whitelists: dumpsys deviceidle whitelist +<package>.
  • Disables Google Play Protect scanning via system property adjustments.
  • Immortal Watchdog: The Go process runs independently of the APK lifecycle. If the victim uninstalls the visible app from the launcher, liblocal-service.so detects package deletion and immediately executes pm install /data/local/tmp/app.apk, resurrecting the malware and restoring its configurations.
• `libmedia_codec.so` (Fast Reverse Proxy):
  • Masquerading under a media codec naming convention, this binary is a compiled client based on the open-source Fast Reverse Proxy (FRP / `frpc`) framework.
  • Reads connection parameters from server_config.json to initiate an outbound, encrypted reverse tunnel back to the threat actor's C2 infrastructure.
  • Routes the internal ADB daemon to the attacker's workstation, bypassing enterprise NAT, corporate firewalls, and carrier-grade network boundaries.

4. Generative AI Real-Time UI Automation & Hardware Keylogging

RatHat addresses a classic limitation of mobile banking trojans: app redesigns and localized interfaces frequently break scripted click sequences.

• LLM UI Decision Engine: RatHat captures the current active screen's Accessibility node hierarchy, serializes the tree into XML/JSON, and transmits it via API to a remote LLM. The AI evaluates the layout in real time, determining the optimal bounding boxes and action sequence to achieve attacker goals (e.g., approving funds transfers, disabling 2FA prompts, or clicking confirmation banners).
• Hardware-Level Touch Sniffing: To capture high-security credentials—such as randomized banking PIN pads or apps leveraging FLAG_SECURE—RatHat reads raw hardware input events directly from /dev/input/event*. Using device geometry templates stored in locateValues.json, the malware maps raw X/Y coordinate taps directly to numeric digits and graphical swipe patterns.

Threat Actor Profile & Campaign Attribution

Telemetry and reverse engineering by Zimperium zLabs indicate that RatHat is operated by a technically sophisticated cybercrime syndicate:

• Linguistic and Regional Indicators: Analysis of the embedded LLM prompt templates and command orchestration scripts revealed Chinese-language prompt instructions and development comments.
• Monetization Architecture: The group functions as a specialized mobile financial theft operation, targeting banking institutions, decentralized cryptocurrency wallets, and payment processors across North America, Europe, and the Asia-Pacific region.
• Operational Transition: The deployment of local ADB pairing combined with dynamic generative AI UI parsing represents an inflection point, signaling that threat actors are moving away from traditional overlay-only banking trojans toward fully automated, agentic mobile takeover tools.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Enforce MDM / EMM Security Policies:
  • Deploy Mobile Device Management (MDM) configuration profiles that explicitly disable Developer Options (DISALLOW_DEBUGGING_FEATURES) across enterprise-managed and BYOD devices.
  • Enforce the DISALLOW_INSTALL_UNKNOWN_SOURCES restriction to block application sideloading from browsers, messaging apps, and external storage.
• Enterprise Accessibility Auditing:
  • Utilize Mobile Threat Defense (MTD) solutions to identify and flag applications requesting Accessibility Service permissions outside vetted assistive technologies.
• Device Remediation:
  • If RatHat is detected, simple application uninstallation will fail due to the persistent /data/local/tmp watchdog daemon. A complete factory data reset or low-level ADB reboot with pm uninstall and termination of background PIDs is required.

2. Network & Perimeter Defenses

• Block Reverse Proxy Infrastructure:
  • Detect and restrict outbound traffic matching Fast Reverse Proxy (FRP) communication handshakes and custom proxy protocols.
  • Inspect corporate Wi-Fi egress for anomalous outbound persistent TCP sessions originating from mobile device subnets directed toward known bulletproof hosting providers.
• Snort / Suricata Rule for FRP Handshake Detection:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"POLICY-OTHER Suspected Fast Reverse Proxy (FRPC) Outbound Handshake"; flow:to_server,established; content:"frp"; depth:16; classtype:misc-activity; sid:20261016; rev:1;)

3. Endpoint Detection & Hunting Query

YARA Rule: RatHat Native Stager & Masqueraded Go Daemons

rule Android_RatHat_Native_Daemons {

meta:

description = "Detects RatHat masqueraded Go binaries and FRP clients in Android staging directories"

author = "CyberNewsAI Threat Intelligence"

date = "2026-09-17"

severity = "Critical"

strings:

$s1 = "/data/local/tmp/frpc" ascii

$s2 = "/data/local/tmp/app.apk" ascii

$s3 = "locateValues.json" ascii

$s4 = "server_config.json" ascii

$s5 = "liblocal-service.so" ascii

$s6 = "libmedia_codec.so" ascii

$f1 = "fatedier/frp" ascii

$f2 = "dumpsys deviceidle whitelist" ascii

condition:

uint32(0) == 0x464C457F and (2 of ($s*) or (all of ($f*)))

}

Forensic ADB Inspection Script (Incident Response)

// Forensic inspection for RatHat artifacts on suspected Android devices

adb shell "ls -la /data/local/tmp/"

adb shell "ps -ef | grep -E 'liblocal-service|libmedia_codec|frpc'"

adb shell "settings get global adb_wifi_enabled"

adb shell "dumpsys package | grep -E 'locateValues.json|server_config.json'"