In short: On 17 September 2026, Zimperium's zLabs published an analysis of RatHat, a new Android banking trojan. Unlike earlier malware, it uses generative AI to navigate device interfaces, autonomously activates Wireless Debugging, and connects to the Android Debug Bridge (ADB) — no USB cable needed. It then gains shell-level access to the device: stealing banking PINs through raw touch-event tracking, intercepting SMS one-time passwords, blocking removal, and reinstalling itself after deletion attempts.
How RatHat reaches your phone
RatHat spreads through smishing messages, malicious advertisements, third-party forums, and fake download portals. Victims receive a link to an APK file disguised as a streaming service, banking app, or browser update. Installing from outside official stores lets the malware in. Zimperium's zLabs attributed the campaign to China-based operators. The ADB-over-Wi-Fi infection chain was also observed in the earlier RedHook trojan — see our coverage of the RedHook Android trojan.
Once installed, RatHat requests Accessibility Service permissions through localised HTML pages with banking-themed lures. This single permission is the key that lets the malware drive the OS interface and interact with any installed application.
How RatHat hijacks Android through ADB
With Accessibility granted, the malware acts automatically — no further user interaction required. Using synthetic taps, it opens Developer Options, activates Wireless Debugging, opens the ADB pairing screen, and reads the temporary six-digit pairing code directly from the display. An embedded ADB library then pairs the malware with the device's local ADB daemon over the loopback interface — no USB cable needed, entirely invisible to the user.
The trojan then deploys two persistent components:
- liblocal-service.so — a privileged local agent that manages permissions and restrictions on the device;
- libmedia_codec.so — a reverse-proxy client that maintains a persistent tunnel to the attacker's command server.
The result is shell-level execution rights (uid 2000) on the victim's device — enabling arbitrary commands, silent app installs and removals, and access to protected data stores. This goes far beyond what a typical banking overlay trojan can achieve. Learn how encrypting your traffic reduces interception risk on our LiMP VPN features page.
What data RatHat steals and how
RatHat deploys several data-theft methods simultaneously:
- Touch-coordinate PIN recovery. The trojan monitors raw touch events via the
geteventutility on/dev/input, recording coordinates and timestamps. By mapping these against the keyboard layout of the specific device model, it reconstructs entered PINs, passwords, and pattern-lock inputs — bypassing screenshot restrictions and Accessibility-based capture defences. - SMS and notification interception. One-time passwords and 2FA codes from banking and payment apps are captured from SMS messages and push notifications in real time.
- Phishing overlays. Fake login screens are displayed over legitimate banking, crypto, and payment apps to harvest credentials directly.
- AI-driven interface navigation. For complex tasks, RatHat serialises device Accessibility data as XML and forwards it to a generative AI model on the attacker's server. The AI analyses the interface and returns step-by-step instructions dynamically — without hardcoded scripts, making the trojan's behaviour unpredictable and resistant to static signature detection.
- Browser data. History and stored data from Chrome, Brave, Opera, and other browsers are collected and exfiltrated.
Why RatHat is hard to remove
When a user attempts to uninstall the malicious app, RatHat overlays a fake Google Play error screen, making the victim believe the removal failed due to a technical issue. Even if uninstallation formally completes, the liblocal-service.so agent remains active outside the app's normal lifecycle. It can reinstall the APK, restore permissions, and reactivate Accessibility features without prompting the user. Complete remediation typically requires a factory reset.
How to protect your Android device
Prevention is far simpler than remediation after RatHat is installed.
Only install apps from Google Play. No legitimate service sends an APK download link via SMS or an ad. Confirm that installation from unknown sources is disabled in your device settings.
Treat Accessibility permission requests as a red flag. Accessibility Service is designed for screen readers and accessibility tools — not for banking, delivery, or utility apps from unknown sources. If an unfamiliar app requests it, deny and remove the app immediately. Audit which apps hold Accessibility access in Settings and revoke any you do not recognise.
Keep Developer Options and Wireless Debugging disabled. There is no reason for these to be active unless you actively develop Android apps. Check: Settings → About Phone → confirm Developer Options is off.
Monitor for unexplained battery drain or data usage. Background malware activity often manifests as abnormal battery consumption or unusual network traffic spikes. Regularly audit running apps for Accessibility access if you notice these signs.
Encrypt traffic on public networks. A VPN cannot stop malware already installed on the device, but it encrypts all outgoing traffic — including data RatHat tries to transmit to its command server. On public or corporate Wi-Fi, that traffic will be unreadable to network observers. LiMP VPN supports WireGuard on Android and iOS — see our pricing page for plans.
Sources
- Anti-Malware.ru — RatHat trojan enables Android debugging and steals PINs (17 September 2026)
- GBHackers — RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs (September 2026)
- CyberPress — New RatHat Android Malware Uses AI and ADB to Steal Banking Credentials and OTPs (September 2026)