RatHat hardware-level keylogging via /dev/input touch capture

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

Detects the RatHat Android malware component using getevent or direct access to /dev/input event files to capture user PINs and patterns. The rule filters for processes running under UID 2000 (shell) or identifying as liblocal-service, which are consistent with the malware's keylogging behavior.