RatHat GenAI Navigation Command 'SCROLL_DOWN' in HTTP Response

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•5

This rule detects network traffic originating from the RatHat Android malware, specifically identifying the 'SCROLL_DOWN' command in HTTP response bodies. This suggests the malware is receiving instructions from a C2 server to perform UI automation or interaction tasks.