AI‑Powered RatHat Malware Hijacks Android Phones to Snatch Banking Data

Security researchers have identified a new strain of Android malware, dubbed RatHat, that leverages generative artificial intelligence to autonomously explore compromised devices and harvest financial information. The malicious code is capable of locating banking apps, extracting login credentials, and capturing one‑time passwords (OTPs) in real time, giving attackers a direct line to victims' accounts.

Unlike conventional Android threats that follow static scripts, RatHat uses AI models to adapt its behavior to the specific layout and security settings of each phone. By analyzing UI elements, the malware can navigate menus, fill in login forms and intercept SMS or push‑based OTP messages without user interaction. This dynamic approach makes detection harder, as the code can mimic legitimate app behavior and avoid known signatures.

The campaign appears to target users of popular mobile banking services across multiple regions. Researchers observed that once the malware gains access, it establishes a persistent foothold by reinstalling itself even after a user attempts to remove the infected application. The self‑reinforcement mechanism involves downloading a fresh payload from command‑and‑control servers, effectively resetting the infection cycle.

The discovery was first reported by cybersecurity outlet Hackread, which cited analysis from independent threat‑intel teams. While the exact number of affected devices remains unclear, the use of generative AI marks a notable evolution in mobile malware sophistication. Experts warn that traditional anti‑malware tools, which rely on pattern matching, may struggle to keep pace with threats that can generate new code paths on the fly.

Authorities and security firms are urging Android users to tighten device hygiene: install apps only from trusted sources, keep operating systems and security patches up to date, and monitor banking activity for unauthorized transactions. Researchers suggest that future defenses will need to incorporate behavioral analytics and AI‑based detection to counter the adaptive tactics demonstrated by RatHat.