RatHat Android Banking Trojan Operates as Malware‑as‑a‑Service, Leveraging Gemini Console to Target High‑Value Users

Security firm Cleafy has identified a new operational model for the RatHat Android banking trojan, which is being offered as a malware‑as‑a‑service platform that uses a web‑based console named Gemini to pinpoint and exploit higher‑value victims.

According to Cleafy, the RatHat operators develop and distribute the Android banking trojan, then manage compromised devices through the Gemini console. The interface allows the attackers to monitor infected phones, deploy additional payloads, and select targets based on financial profiles, effectively turning ordinary smartphones into remote banking fraud tools.

The company says it has tracked almost one hundred separate deployments of the Gemini console since April 2026, indicating a rapid expansion of the service within a few months. Each deployment represents a distinct instance of the console being used to control a network of infected devices, suggesting a growing client base for the RatHat service.

RatHat’s approach reflects a broader trend in cybercrime where sophisticated tools are packaged and sold to affiliates, lowering the technical barrier for conducting large‑scale financial theft. Android banking trojans have been a persistent threat because of the platform’s market share and the ease with which malicious apps can be disguised as legitimate banking or utility applications. By centralising control in a web console, the operators can scale attacks, automate victim selection, and quickly adapt to security countermeasures.

Cleafy’s findings underscore the need for heightened vigilance among mobile users and financial institutions. Security experts recommend strict app vetting, regular device updates, and the use of multi‑factor authentication to mitigate the risk of credential harvesting. Meanwhile, law‑enforcement and cybersecurity teams are likely to focus on disrupting the infrastructure behind services like Gemini, which could curtail the proliferation of RatHat and similar malware‑as‑a‑service offerings.