New Android Malware RatHat Discovered

Cybersecurity researchers have identified a new Android malware named RatHat, classified as a threat by actors based in China. This malware utilizes an AI-driven system to control and navigate compromised devices. RatHat is primarily spread through targeted smishing campaigns (SMS phishing) and malvertising, leading users to misleading third-party download portals. The malware is designed to maintain access to the affected device even after uninstallation. This is achieved through the abusive use of the Android Debug Bridge (ADB), allowing attackers to retain control over the device even if the malware itself is removed.

This technique poses a significant challenge to the security of Android devices. RatHat is not only capable of stealing data but can also control various functions of the device, including the camera and microphone. The malware can be configured to run in the background, making it difficult for the user to detect. Researchers have found that the malware is capable of self-updating to evade detection by security software. The spread of RatHat occurs through targeted phishing messages, often disguised as legitimate communications.

Users receive SMS messages prompting them to click on a link to download purported security updates or other services. However, these links lead to malicious downloads that install the malware. Another concerning feature of RatHat is its use of artificial intelligence to simulate user interaction, thereby increasing the likelihood of successful malware installation. The AI can also be used to monitor user activities and plan targeted attacks. Security researchers recommend that users regularly check their devices for suspicious activities and exercise caution with links in SMS messages.

The installation of security software is also strongly advised to detect and block potential threats early. The discovery of RatHat raises questions about the security of Android devices, particularly regarding the use of ADB. Experts warn that many users may not know how to use ADB securely, making them vulnerable to attacks. The malware could also evolve in the future to develop even more sophisticated methods of bypassing security measures. Researchers have already reported the malware to relevant security authorities to promote broader awareness and protective measures.

The exact number of affected devices is currently unknown; however, it is estimated that the malware is active in several countries. The vulnerability exploited by RatHat could potentially affect millions of users. Security authorities advise that the ADB function on Android devices should only be enabled when absolutely necessary and disabled again after use. This could help reduce the risk of infection by malware like RatHat. The malware is an example of the increasing threat posed by mobile malware, which is becoming increasingly sophisticated.

Researchers have classified the malware as one of the most serious threats to Android users in recent years. The combination of AI and the ability to self-update makes RatHat a particularly dangerous player in the realm of cybercrime. The malware could become more widespread in the coming months if no appropriate countermeasures are taken. The vulnerability exploited by RatHat could also be used in future malware variants, underscoring the need for continuous security updates and reviews. Experts recommend that users regularly check their devices for updates and ensure that they have the latest security features enabled. The RatHat malware was first discovered in September 2026 and has already raised concerns in several countries.