Overview
Cybersecurity researchers at Zimperium have disclosed a novel Android remote access trojan (RAT) dubbed RatHat, attributed to China-based threat actors. What distinguishes RatHat from conventional mobile malware is its integration of a generative AI assistant to autonomously navigate device interfaces — and its ability to retain shell-level access even after the victim uninstalls the app by abusing Android Debug Bridge (ADB) self-pairing.
Distributed via smishing campaigns, malvertising, and deceptive third-party APK portals, RatHat represents a meaningful evolution in AI-augmented mobile threats.
Technical Analysis
RatHat’s architecture comprises three components: a malicious Android application (dropper), a Go-based agent, and an FRP (Fast Reverse Proxy) client for C2 tunnelling.
Infection chain:
- The dropper APK acquires Accessibility Services permissions.
- It abuses those permissions to silently enable Developer Options and Wireless Debugging.
- It extracts the 6-digit ADB pairing code and initiates autonomous local ADB self-pairing — breaking out of the Android application sandbox with shell-level privileges.
- Native daemons are staged with persistent shell access, surviving app uninstallation.
AI-assisted device control: RatHat serialises the device’s live Accessibility tree to XML and transmits it to a generative AI assistant. The AI resolves named UI element coordinates as JSON, enabling synthetic clicks and autonomous device navigation — effectively acting as an AI agent operating on behalf of the attacker.
Anti-analysis techniques include:
- Container tampering: ZIP flag manipulation to confuse static analysis tools.
- Manifest bomb: Undocumented
0x9999chunk headers crash automated pipelines. - DEX bytecode poisoning: Invalid
element_widthpseudo-instructions break disassemblers. - Dual string-encryption: Base64-wrapped custom encryption (StringCrypto) resists string extraction.
Additional capabilities: overlay credential harvesting, screen recording via MediaProjection API, SMS interception, and fake Google Play Store overlays to suppress uninstall attempts.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): The malware actively weaponises a commercial generative AI service to perform autonomous UI interaction, a novel abuse of AI capabilities in a malware context.
- AML.T0043 (Craft Adversarial Data): The serialised accessibility tree payloads sent to the AI constitute crafted inputs designed to elicit precise coordinate outputs for exploitation.
- LLM08 (Excessive Agency): The generative AI is granted implicit agency to direct device actions based on attacker-controlled prompts — without guardrails or context about its role in a malicious pipeline.
- LLM02 (Insecure Output Handling): AI-generated coordinate JSON is directly consumed by the malware to execute synthetic clicks, with no validation layer.
Impact Assessment
RatHat poses a high risk to individual Android users and organisations that permit personal devices on corporate networks. The persistence mechanism — surviving uninstallation through ADB shell daemons — significantly raises remediation complexity. The AI-assisted navigation capability lowers the bar for attackers to interact with arbitrary apps without hardcoding UI logic, making the malware more adaptable and harder to signature-match behaviourally.
Mitigation & Recommendations
- Disable Developer Options and Wireless Debugging on all non-development Android devices.
- Enforce MDM policies blocking sideloaded APKs from unknown sources.
- Monitor ADB pairing events at the network and endpoint level for anomalous activity.
- Audit Accessibility Service grants on managed devices; revoke unnecessary permissions.
- Deploy mobile threat defence (MTD) solutions capable of detecting accessibility abuse and ADB self-pairing behaviour.
- Educate users on smishing and malvertising tactics used to deliver the initial dropper.