RatHat Android malware steals bank logins, verification codes and screen-lock secrets
RatHat spreads through fake Android downloads promoted by texts and adverts, stealing bank logins, verification codes and screen locks. Keep Play Protect on; if infection is confirmed, seek help to factory-reset the device and secure exposed accounts.
Install apps through Google Play and keep Play Store → profile icon → Play Protect → Settings → Scan apps with Play Protect switched on. If RatHat infection is confirmed, ask your phone maker or a trusted technician to help factory-reset the device: Malwarebytes warns that ordinary app removal can leave its persistence component behind. Using a clean device, change exposed passwords and contact your bank about possible account access.
What’s happening
Zimperium disclosed RatHat on 16 September after finding Android malware distributed through phishing texts, malicious adverts and deceptive download sites. It targets people who install the malicious app and grant Accessibility access. Fake banking and payment screens capture credentials, while other features intercept verification codes and reconstruct screen-lock secrets. A separate background component can reinstall the app after removal. Cleafy later traced the same malware design to late 2025 and February 2026, and found nearly 100 control-console deployments since April, rather than 100 infected devices. Its September analysis found Gemini helping the malware navigate unfamiliar settings and ranking victims by estimated bank balances; it found no AI-driven fraudulent transfers in the analysed samples. Google said Play Protect protects against known versions, but this is not confirmation that an infected phone has been cleaned. As at 3 November, the reviewed sources provide no infection total, confirmed loss figure or campaign takedown.
- What
- Scam
- Affects
- Android devices, particularly those used for banking, payments and cryptocurrency
- Affected
- Android devices with RatHat installed and Accessibility access granted; no complete affected-version range published
- Fixed in
- Nothing to patch
- Since
- 16 Sept 2026
- Closed
- 28 Sept 2026
Timeline
- Update
Cleafy traced nearly 100 control-console deployments since April, associated with campaigns across Europe, Latin America and South-East Asia; these were not infection counts. Its analysis found Gemini estimating victims' bank balances from stolen texts to help operators prioritise targets, and linked earlier malware samples to late 2025 and February 2026.
- Vendor revised
Google told BleepingComputer that it had detected no RatHat apps on Google Play. It said Google Play Protect automatically protected users against known versions on devices with Google Play Services.
- Made publicNothing to patch
Zimperium disclosed RatHat campaigns using phishing texts and malicious adverts to distribute Android apps outside Google Play. The malware could steal financial credentials, verification codes and screen-lock secrets, and reinstall itself after removal.
Sources
- RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank AccountsZimperium · 16 Sept 2026
- From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHatCleafy · 28 Sept 2026
- New RatHat Android malware uses AI to automate device controlBleepingComputer · 17 Sept 2026
- RatHat Android Malware Console Uses Gemini to Identify Higher-Value VictimsThe Hacker News · 28 Sept 2026
- New Android malware uses AI to steal bank logins and PINsMalwarebytes · 18 Sept 2026
- Remove malware or unsafe software — Android phone & tabletGoogle
- Secure a hacked or compromised Google AccountGoogle