Mobile malware sending Accessibility-tree XML to GenAI API for UI targeting

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects network activity associated with the RatHat Android malware, specifically the exfiltration of accessibility tree data and calls to Google's Generative Language API (gemini-2.5-flash-lite) for UI target resolution and automation.