RatHat Android Malware Console uses Gemini to locate victims

RatHat operators create and publish a banking trojan for Android and control infected phones via a web-based console, according to security firm Cleafy. Cleafy has identified nearly 100 deployments of this console since April 2026, indicating a malware-as-a-service model where each customer manages a separate copy.

See also: RatHat Android: New malware steals PINs and passwords from mobile phones

The console stores data collected from each phone, including text messages and passwords entered into fake login screens that overlay banking apps. Its latest version uses Google’s Gemini AI model to estimate each victim’s bank account balance from these messages, classifying phones into high- and medium-value groups.

However, nothing in the samples analyzed by Cleafy uses the model to transfer money; its role is to determine which victims are worth an operator's time.

The malware on victims’ phones has changed little since late 2025, although the console behind it has been replaced. Samples from late 2025 and February 2026 were linked to an older console called Fisher. Three new versions were in use between April and September 2026, all built from the same code. The first is called BlackCat Remote Control Management, followed by Panda Workshop V5 and V6.

Each version also acts as a build tool, allowing operators to create malware, hide it inside an innocuous-looking application, and publish it to Amazon S3 or a web server without having to manage the hosting setup. The console can also rebuild the application at a scheduled time, creating new files of the same malware to avoid detection by security tools.

RatHat reaches phones through text messages and online advertisements that lead to third-party websites for download. Once installed, the app requests Accessibility access, allowing it to read the screen and tap for the user. This access allows the app to enable wireless debugging, read the pairing code from the screen, and connect to the phone's Android Debug Bridge (ADB).

See also: RemControl: New Android malware steals banking information

This gives the malware a shell that runs as the Android shell user (UID 2000), in addition to the permissions granted to the application. From the console, the operator can use this shell with a click. A deploy button launches a separate program written in Go that remains accessible through a reverse tunnel, a connection that opens from the phone to the operator's server. The pairing with ADB is done automatically, but the Go program is only executed after the operator clicks deploy.

The Go program changes the way the operator can monitor the screen. Screen capture through the application requires user permission and displays a recording icon while it is running. In contrast, the Go program uses tools called minicap and minitouch to broadcast the screen and send taps without requiring permission prompts or displaying a recording icon.

However, neither tool works on Android 14 and later, leaving those phones with their own screen capture and permission prompt. Cleafy also described a fallback method using a tool called screencap at around 5 frames per second, but didn't specify which Android versions it covers.

The Go program continues to run after the victim removes the app, until the phone is rebooted. It can also reinstall the app after deletion and restore Accessibility access. None of the above provides steps to completely remove the malware.

See also: Mantax Otax: New Android malware encrypts files and steals data

Cleafy found the deployments by searching page titles and console web code, counting console deployments rather than infected phones. The report did not define what constitutes a deployment.