AI‑Powered “RatHat” Android Malware Targets Financial Information, Researchers Find

Security firm Zimperium has identified a new Android threat it has named RatHat, a malicious program that combines traditional spyware functions with artificial‑intelligence techniques to harvest users' financial data.

The malware operates as both a spying tool and a backdoor, granting its operators the ability to monitor device activity, capture input from financial applications, and maintain persistent access for future exploitation. Zimperium’s analysis indicates that RatHat can record keystrokes, take screenshots, and exfiltrate files without the user’s knowledge.

What sets RatHat apart is its use of machine‑learning models to pinpoint high‑value targets. The AI component scans installed apps, identifies those associated with banking, payments, or investment services, and then activates data‑stealing routines only when those apps are in use. This selective behavior helps the malware evade detection by limiting its activity to moments of financial relevance.

The emergence of AI‑enhanced malware reflects a broader shift in the cyber‑crime landscape, where attackers increasingly leverage automation to increase efficiency and stealth. Android remains a popular platform for malicious actors due to its large global user base and fragmented update ecosystem, making it fertile ground for sophisticated threats like RatHat.

Potential victims include anyone who installs apps from unofficial sources or clicks on malicious advertising that can deliver the payload. Once on a device, RatHat can remain hidden for extended periods, continuously siphoning credentials, transaction details, and other sensitive information that can be sold on underground markets.

Zimperium advises users to keep their operating system and applications up to date, employ reputable mobile security solutions, and restrict installations to trusted app stores. The firm also calls on developers to implement stronger runtime protections and for platform providers to accelerate security patches. Ongoing monitoring of RatHat’s activity will help inform future defensive measures and guide law‑enforcement investigations into the actors behind the campaign.