RatHat: AI-Powered Android Malware Hijacks Devices via ADB and Accessibility Abuse A newly identified Android banking trojan, RatHat, leverages artificial intelligence, Accessibility Service abuse, and Android Debug Bridge (ADB) pairing to steal sensitive data, including banking credentials, payment PINs, one-time passwords (OTPs), and lock-screen patterns. The malware spreads through smishing, malicious ads, phishing sites, and third-party app stores, tricking victims into installing APK files disguised as legitimate apps such as streaming services, browsers, or financial applications. Unlike typical Android malware, RatHat employs a multi-stage infection chain to maintain persistence. After installation, it uses localized HTML lures to convince victims to enable Accessibility Services, then automates the activation of Wireless Debugging by simulating taps on the device’s Build Number setting. Once enabled, the malware extracts the ADB pairing code and port number, allowing it to establish shell-level access via its embedded ADB library without requiring a USB connection. RatHat deploys two Go-based binaries to sustain its attack: - liblocal-service.so: A privileged local agent running from `/data/local/tmp`. - libmedia_codec.so: A Fast Reverse Proxy client that creates a persistent tunnel to the attacker’s command-and-control (C2) server. The malware also incorporates AI-driven UI automation, serializing the device’s Accessibility tree into XML and sending it to a generative AI assistant. This enables real-time adaptation, allowing RatHat to identify screen coordinates, extract visible text, and execute dynamic navigation actions such as scrolling rather than relying on static scripts. Once active, RatHat targets banking, cryptocurrency, payment, and messaging apps with fake HTML overlays, capturing usernames, passwords, card details, and PINs. It intercepts SMS messages and notifications to steal OTPs and two-factor authentication codes, while an Accessibility-based keylogger logs text inputs including masked password fields. The malware also monitors browser URLs across Chrome, Brave, Opera, Edge, DuckDuckGo, and Samsung Internet, and uses the `getevent` tool to track raw touch data, reconstructing PINs and unlock patterns from stored keypad layouts. Security researchers at Zimperium have identified indicators of compromise (IOCs), including the native payloads liblocal-service.so and libmedia_codec.so, though C2 domains and IP addresses remain defanged to prevent accidental resolution. The malware’s AI-assisted automation and ADB-based persistence mark a significant evolution in Android banking trojans, enabling stealthier, more adaptive attacks on financial and personal data.