{"id":"rathat-android-banking-malware-sep-2026","category":"scam","status":"closed","title":"RatHat Android malware steals bank logins, verification codes and screen-lock secrets","tldr":"RatHat spreads through fake Android downloads promoted by texts and adverts, stealing bank logins, verification codes and screen locks. Keep Play Protect on; if infection is confirmed, seek help to factory-reset the device and secure exposed accounts.","summary":"Zimperium disclosed RatHat on 16 September after finding Android malware distributed through phishing texts, malicious adverts and deceptive download sites. It targets people who install the malicious app and grant Accessibility access. Fake banking and payment screens capture credentials, while other features intercept verification codes and reconstruct screen-lock secrets. A separate background component can reinstall the app after removal. Cleafy later traced the same malware design to late 2025 and February 2026, and found nearly 100 control-console deployments since April, rather than 100 infected devices. Its September analysis found Gemini helping the malware navigate unfamiliar settings and ranking victims by estimated bank balances; it found no AI-driven fraudulent transfers in the analysed samples. Google said Play Protect protects against known versions, but this is not confirmation that an infected phone has been cleaned. As at 3 November, the reviewed sources provide no infection total, confirmed loss figure or campaign takedown.","action":"Install apps through Google Play and keep Play Store → profile icon → Play Protect → Settings → Scan apps with Play Protect switched on. If RatHat infection is confirmed, ask your phone maker or a trusted technician to help factory-reset the device: Malwarebytes warns that ordinary app removal can leave its persistence component behind. Using a clean device, change exposed passwords and contact your bank about possible account access.","product":"Android devices, particularly those used for banking, payments and cryptocurrency","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["android","rathat","malware","phishing","credential-theft","banking"],"affected":["Android devices with RatHat installed and Accessibility access granted; no complete affected-version range published"],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts","url":"https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts","by":"Zimperium","date":"2026-09-16"},{"kind":"research","title":"From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat","url":"https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat","by":"Cleafy","date":"2026-09-28"},{"kind":"news","title":"New RatHat Android malware uses AI to automate device control","url":"https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/","by":"BleepingComputer","date":"2026-09-17"},{"kind":"news","title":"RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims","url":"https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html","by":"The Hacker News","date":"2026-09-28"},{"kind":"news","title":"New Android malware uses AI to steal bank logins and PINs","url":"https://www.malwarebytes.com/blog/news/2026/09/new-android-malware-uses-ai-to-steal-bank-logins-and-pins","by":"Malwarebytes","date":"2026-09-18"},{"kind":"advisory","title":"Remove malware or unsafe software — Android phone & tablet","url":"https://support.google.com/accounts/answer/9924802?co=GENIE.Platform%3DAndroid&hl=en","by":"Google","date":""},{"kind":"advisory","title":"Secure a hacked or compromised Google Account","url":"https://support.google.com/accounts/answer/6294825?hl=en","by":"Google","date":""}],"started":"2026-09-16","closed":"2026-09-28","created":"2026-11-03T21:43:05.134Z","updated":"2026-11-03T21:43:05.134Z","cve_notes":[],"timeline":[{"at":"2026-09-28","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Cleafy traced nearly 100 control-console deployments since April, associated with campaigns across Europe, Latin America and South-East Asia; these were not infection counts. Its analysis found Gemini estimating victims' bank balances from stolen texts to help operators prioritise targets, and linked earlier malware samples to late 2025 and February 2026.","url":"https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat","by":"Cleafy","patch":null},{"at":"2026-09-21","added":"2026-11-03T21:35:43.306Z","kind":"vendor-revised","text":"Google told BleepingComputer that it had detected no RatHat apps on Google Play. It said Google Play Protect automatically protected users against known versions on devices with Google Play Services.","url":"https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/","by":"BleepingComputer","patch":null},{"at":"2026-09-16","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"Zimperium disclosed RatHat campaigns using phishing texts and malicious adverts to distribute Android apps outside Google Play. The malware could steal financial credentials, verification codes and screen-lock secrets, and reinstall itself after removal.","url":"https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts","by":"Zimperium","patch":"na"}],"url":"https://hard.fyi/live/rathat-android-banking-malware-sep-2026/","json":"https://hard.fyi/api/live?id=rathat-android-banking-malware-sep-2026"}