Zimperium discovers RatHat AI malware targeting Android financial apps
This digest was compiled by AI from multiple sources — links to the originals are below.
Mobile security firm Zimperium has discovered RatHat, a new AI-powered Android malware that gains admin-level control and steals data from financial apps. The malware has infected 162 apps in the wild, which report to a dozen attacker-controlled servers. RatHat primarily targets WeChat Pay and Alipay users, but other financial apps are also at risk.
Key Facts
- RatHat was discovered by mobile security firm Zimperium and has infected 162 apps in the wild.
- The malware primarily targets WeChat Pay and Alipay, but Malwarebytes notes other financial apps can also be targeted.
- RatHat tricks users into downloading fake apps, such as Google Chrome, through a web page mimicking the Google Play Store.
- Once installed, RatHat uses accessibility permissions to unlock Wireless Debugging and grant itself ADB Shell permissions, gaining admin access.
- The malware can steal screen content, raw touch input, PIN codes, pattern unlocks, SMS messages, and two-factor authentication codes.
Infection Chain
RatHat tricks users into downloading what appears to be a legitimate app, such as Google Chrome, via a fake web page that mimics the Google Play Store. Once opened, the app asks for accessibility permissions, which it then uses to navigate the phone's menu system and unlock Wireless Debugging, a legitimate developer tool. RatHat then grants itself ADB Shell permissions, effectively gaining admin access to the device. Next, it installs an AI-assisted agent that runs system commands to steal information and a proxy client that tunnels stolen data back to the hacker. Sav Wheeler, a research engineer for Malwarebytes, said the infection chain is comparable to following a phishing email on Windows and granting administrator permissions.
Data Theft Capabilities
RatHat runs in the background and captures information that appears on the screen, including usernames, passwords, and two-factor authentication codes. It can steal raw touch input from the touchscreen, allowing it to recreate PIN codes and pattern unlock codes. The malware can also capture SMS messages, thereby intercepting security codes. Researchers have found 162 infected apps in the wild, which report back to a dozen servers run by attackers. Per Zimperium, the malware can be traced to attackers in China.
Detection and Removal
The only way to find RatHat is to run an antivirus scan that detects the software. Malwarebytes is a free option on Google Play that can detect the malware, according to Wheeler. RatHat is sneaky and difficult to quarantine, CNET reports.
6 sources
Time · lag behind first