Executive Summary
Security researchers have identified a novel Android malware strain named RatHat, attributed to China-based operators. RatHat is primarily distributed via smishing and malvertising campaigns, utilizing an automated multi-stage infection pipeline. It distinguishes itself by using generative AI to intelligently navigate compromised device interfaces in real-time, making it significantly more adaptable than traditional scripted mobile threats.
Technically, RatHat employs a unique method of privilege escalation by abusing Android Accessibility services to enable Wireless Debugging and autonomously pair with the local ADB daemon. This process allows the malware to stage native Go-based daemons with shell-level privileges. These daemons operate outside the standard application sandbox, enabling hardware-level keylogging and persistent reverse-proxy tunnels through FRP (Fast Reverse Proxy).
RatHat poses a severe threat to the financial sector, specifically targeting banking and payment applications like WeChat and Alipay through deceptive HTML overlays. Its persistence mechanism is particularly resilient; even if the primary application is uninstalled, the background Go agent remains active to silently reinstall the malware and restore its permissions, resulting in a permanent backdoor for attackers.
Key Details
Threat Name
RatHat Android Malware
Affects
Check Point
Adversary
China-based threat actors Other Adversaries and Aliases: China-based operators
MITRE Techniques
Malware/Tools
RatHat, SpiceRAT, Chosen Brick, BambooToken, StringFog, FRP