AI‑Powered Android Trojan ‘RatHat’ Turns Accessibility Features Into Spyware

Security researchers at Zimperium have detailed a newly discovered Android malware family dubbed RatHat, which leverages the operating system's accessibility services to gain extensive control over compromised devices. By manipulating screen interactions, abusing debugging interfaces, and exfiltrating stored credentials, the trojan provides attackers with a potent toolkit for surveillance, data theft, and further exploitation.

RatHat’s core technique involves requesting the Accessibility Service permission, a feature intended to help users with disabilities. Once granted, the malware can simulate touches, read on‑screen content, and navigate apps without user involvement. This capability enables it to bypass typical security prompts and operate stealthily in the background.

In addition to screen control, the threat actor exploits Android's debugging bridge (ADB) by programmatically enabling developer options and establishing a persistent ADB connection. This grants the malicious code low‑level access to the device, allowing it to install additional payloads, modify system settings, and execute arbitrary commands that would otherwise be restricted.

The credential‑stealing component of RatHat targets a wide range of stored data, including saved Wi‑Fi passwords, Google account tokens, and authentication details from popular banking and social media apps. Researchers observed that the trojan harvests this information and transmits it to command‑and‑control servers using encrypted channels, making network‑level detection difficult.

RatHat’s emergence underscores a growing trend in Android threats that combine legitimate system functions with malicious intent. Accessibility abuse has been seen in earlier malware, but the integration of AI‑driven decision making—allowing the trojan to adapt its behavior based on the apps it encounters—marks a notable escalation in sophistication.

Experts warn that the trojan’s reliance on user‑granted permissions means conventional anti‑malware solutions may miss it until it has already established a foothold. Zimperium recommends users scrutinize permission requests, avoid installing apps from untrusted sources, and keep devices updated with the latest security patches. Ongoing analysis aims to track RatHat’s distribution channels and identify any affiliated threat groups, signaling a continued need for vigilance in the mobile security landscape.