New Android malware uses AI to take over your phone

A new Android Trojan doesn't just infect your phone, it thinks its way around it. Researchers at Zimperium's zLabs have picked apart RatHat, a malware strain that hands a live AI assistant control of the accessibility tree on an infected device, letting it decide where to tap and scroll instead of following a fixed script.

The infection starts with smishing texts and malicious ads pointing to fake download pages disguised as streaming apps or browsers like Chrome.

Once someone sideloads the APK, the app pressures them into enabling Android's Accessibility Service, often citing a fake network restriction or a bogus financial reward.

This access to accessibility services is what makes RatHat different from the average mobile malware. It stealthily goes through Developer Options and enables Wireless Debugging while fetching the six-digit authentication code displayed on the screen to authenticate itself over the Android Debug Bridge without the involvement of a user or a separate device.

This way, the malware acquires an ADB session at the shell level, which it leverages to download a Go-based agent capable of carrying out privilege-escalation operations along with a reverse-proxy client that allows tunnelling to bypass the firewall and connect to the attackers’ server. 

As a result of the AI-powered attack path selection, such mobile malware escapes signature detection.

The malicious software, RatHat, targets applications that are typically associated with finance and banks to steal user IDs, passwords, and MFA codes. 

Another uncommon technique used by this malware involves obtaining touch coordinates directly from the input driver and comparing them to existing keypads and pattern lock screens in order to recover PINs and unlock codes without viewing the display.

Moreover, this malware can intercept SMS messages, achieve limited autonomy on the device, and re-install itself via a background process.

The whole RatHat chain relies on some individual sideloading the app and giving it accessibility permissions; hence, the solution is mostly preventive, i.e., stay away from side loading and avoid giving any app accessibility permissions if the app does not seem to need them.

The Advanced Protection Mode of Google limits the types of apps that can ask for accessibility permissions, while Malwarebytes for Android detects the strain.