Actor Profile

RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected devices. Cleafy has identified nearly 100 separate console deployments since April 2026, indicating a distributed customer base. The MaaS model allows each customer to run their own console instance with account limits and role restrictions, suggesting the developers do not fully trust their clientele. Nearly half of observed infrastructure resides on Singapore-registered network AS4907. Motivation is financial gain through theft of banking credentials and unauthorized transactions from compromised Android devices.

TTPs (Tactics, Techniques, Procedures)

Initial access via SMS phishing and malicious online advertisements leading to third-party app stores (T1660). Social engineering to obtain Accessibility Service permissions (T1629.001). Automated enablement of wireless debugging and ADB pairing via Accessibility abuse (T1629.001). Command and control through reverse tunnels to operator-controlled servers (T1571). Credential harvesting via overlay attacks on banking applications (T1417). Screen capture and remote control using minicap/minitouch tools bypassing Android permissions on versions prior to 14 (T1513). Persistence through a Go-based program surviving app removal until device reboot (T1624). Defense evasion via automated app rebuilding on schedules (hourly) to generate new file hashes (T1406). Use of Google Gemini AI for victim profiling based on SMS content to prioritize high-value targets. Execution of shell commands via Android Debug Bridge with UID 2000 privileges (T1623).

Targets & Patterns

RatHat operators primarily target users of financial services and banking applications on Android devices. The malware specifically overlays fake login screens on banking apps to harvest credentials and monitors SMS messages for banking transaction data. The latest console versions incorporate Google Gemini AI to analyze collected SMS messages and estimate victim bank balances, automatically sorting victims into high-value and mid-value categories. This AI-driven triage allows operators to prioritize victims worth manual intervention, optimizing their time investment. Geographic targeting patterns are not explicitly defined in available data, though distribution occurs through SMS campaigns and online advertising leading to third-party download sites. The malware's built-in tap instructions support multiple phone manufacturers' interfaces, Android versions, and languages, indicating broad targeting across device types and regions.

Historical Context

RatHat malware samples have remained relatively unchanged since late 2025, but the backend console infrastructure has evolved significantly. Early samples from late 2025 and February 2026 connected to a console named Fisher. Between April and September 2026, three new console versions emerged built from the same codebase: BlackCat Remote Control Management (April 2026), Panda Workshop V5 (August 2026), and Panda Workshop V6 (September 2026). The integration of AI for victim profiling represents an evolution in Android banking malware capabilities. Earlier AI-enabled Android malware includes PromptSpy, described by ESET in February 2026, which similarly used Google Gemini to interpret screen layouts and generate tap instructions. RatHat's use of Gemini extends this approach both for operational automation on infected devices and for strategic victim selection at the console level.

Defensive Recommendations

  • Monitor for Android applications requesting Accessibility Service permissions combined with attempts to enable wireless debugging or ADB connections, particularly through automated screen interaction (T1629.001)
  • Implement network-based detection for connections to known RatHat C2 domains (admin.chunhuating[.]best, admin.xiongmaocs[.]pics, admin.rathat[.]live) and IP 8.231.120[.]246
  • Deploy mobile threat defense solutions capable of detecting overlay attacks on banking applications and unauthorized screen capture tools like minicap/minitouch (T1417, T1513)
  • Block or alert on Android applications making API calls to Google Gemini or other AI services from non-legitimate contexts, especially when combined with screen layout data transmission
  • Educate users to only install applications from official app stores and to recognize SMS phishing attempts directing them to third-party download sites (T1660)
  • Hunt for persistence mechanisms involving Go-based programs maintaining reverse tunnels that survive application removal, requiring device reboot for complete remediation (T1624, T1571)