RATHat is an Android banking trojan that abuses Accessibility permissions, wireless ADB debugging, and Gemini AI to gain deep control over infected phones.
The malware escapes the normal Android app sandbox by pairing with the device’s local ADB service and deploying a separate Go-based service with shell-level access.
RATHat is distributed through smishing messages, malicious advertisements, and fake Android app download pages. Victims are lured into installing APK files disguised as trusted applications, including streaming or financial-themed apps.
After installation, the malware attempts to convince the victim to enable Android Accessibility Service permissions.
This is a critical step because Accessibility allows the app to automate screen taps, read interface elements, and navigate through device settings.
RATHat Hijacks Android Devices
The trojan uses this access to enable Developer Options and Wireless Debugging. It then reads the on-screen ADB pairing code and port, allowing it to pair with the phone’s local Android Debug Bridge daemon without requiring a computer.
The malware gains a shell session running as Android’s shell user, UID 2000. Using that shell, RATHat drops a Go-based component disguised as liblocal-service.so into /data/local/tmp.
The service operates independently of the malicious Android app and can remain active even after a victim removes the app. It can also reinstall the APK, restore permissions, and re-enable Accessibility access.
A second disguised binary, libmedia_codec.so, is an FRP reverse-proxy client. It creates a tunnel from the phone back to attacker-controlled infrastructure, giving operators persistent remote access through the device’s own debugging environment.
RATHat also integrates Gemini AI to make its device automation more flexible. Android malware often relies on static scripts that fail when device vendors, Android versions, screen layouts, or languages differ.
When static controls fail, RATHat converts the active Accessibility interface tree into XML and sends it to Gemini. The model can identify the coordinates of a requested button, recover displayed text, or return simple navigation actions.
This helps the malware locate controls such as Wireless Debugging settings and pairing options across unfamiliar Android interfaces.
The operators also use AI on the server side. Their control panel can analyze stolen SMS messages, extract potential bank balances, and score infected devices by likely financial value. This allows criminals to prioritize victims without manually reviewing every compromised phone.
RATHat’s infrastructure evolved from an earlier Fisher panel into BlackCat and Panda Workshop versions. The newer Panda Workshop V6 panel added obfuscation, phishing download-page creation, and Gemini-focused AI configuration.
Researchers linked close to 100 panel deployments since April 2026, suggesting the operation may function as a malware-as-a-service platform, cleafy said.
Indicators of Compromise
| Type | Indicator | Associated activity / description |
|---|---|---|
| Domain | admin.chunhuating[.]best | Panda Workshop V6 command-and-control server, observed September 2026 |
| Domain | admin.xiongmaocs[.]pics | Panda Workshop V5 command-and-control server, observed August 2026 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
