RatHat WebView Overlay Injection Targeting WeChat/Alipay Payment Apps

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects the RatHat Android malware attempting to perform a UI overlay attack by requesting the SYSTEM_ALERT_WINDOW permission while specifically targeting payment application packages, such as WeChat (com.tencent.mm) and Alipay (com.eg.android.AlipayGphone), to capture sensitive credentials.