What RatHat does (and why its spooky)

Meet RatHat: a sneaky Android strain that treats your phone like a marionette. It bundles a clever AI-backed UI automation engine that watches the on-screen Accessibility tree, turns it into XML, and asks an external assistant what to tap, where to scroll, and what text to read. In short, it can guide a remote operator through your device without live button-mashing.

This trick is enabled by AI-powered navigation that figures out element coordinates, reads on-screen text, and returns simple commands like SCROLL_DOWN. That makes the malware far more flexible than old-school hard-coded scripts.

Under the hood RatHat abuses Android’s Accessibility features to perform privileged actions. It flips on Developer Options and enables Wireless Debugging so it can get a local shell (ADB) without lugging a laptop around. Once it has shell access, RatHat drops a Go-based agent (liblocal-service.so) that runs commands with shell privileges, bypasses battery restrictions, and keeps the infection alive. If you try to nuke the app, the agent and the malware can each resurrect the other.

  • Installs a persistent agent (liblocal-service.so) with ADB-level powers
  • Runs a second agent (libmedia_codec.so) that opens a reverse-proxy tunnel for remote access
  • Shows fake HTML overlays on banking and crypto apps to steal credentials
  • Intercepts SMS and notifications (yes, OTPs too)
  • Records text-change events, snags URLs from browser address bars, and captures lock-screen PINs/passwords/patterns
  • Intercepts uninstall flows and displays a bogus store error to stop removal

To slow down researchers and automated tools, RatHat also packs anti-analysis tricks like tampered APK containers, an absurdly bloated 61MB manifest, and dodgy DEX pseudo-instructions designed to confuse unpackers.

How it spreads and how to defend yourself

Distribution is old-school social trickery: malvertising, SMS lures, and phishing pages that push APK downloads from outside official app stores. If youre not careful, one mis-tap and the puppet strings are attached.

  • Typical infection vectors: malvertising, phishing pages, and SMS links that ask you to install APKs
  • Indicators of compromise: unexpected prompts for Accessibility, Developer Options suddenly enabled, unfamiliar apps with persistent behavior

Simple hygiene goes a long way. Dont install APKs from sketchy sites, avoid granting Accessibility permissions unless you absolutely trust the app, and keep Play Protect and system updates turned on. If your device starts behaving oddly—strange overlays, OTPs being intercepted, or the uninstall flow getting weird—back up important data and consider a factory reset after removing unknown apps.

Short version: RatHat is a cunning combo of UI automation, remote shells, and persistence tricks. Be suspicious of random APK installs, treat Accessibility permissions like nuclear buttons, and dont let your phone join the puppet show.