RatHat HTML Overlay Injection Targeting WeChat and Alipay

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

This rule detects potentially malicious Android activity targeting financial and messaging applications (WeChat, Alipay). It monitors for suspicious app installation, abuse of Android accessibility services, and unauthorized overlay window activity which are common techniques used by banking trojans for credential theft and unauthorized transaction interception.