There’s a frightening new digital threat that Android users should be aware of. New AI-powered malware called RatHat can automatically gain admin-level control over your Android device, stealing whatever it wants.
RatHat was discovered by mobile security firm Zimperium, which notes that the program tricks people into downloading what appears to be a legitimate app, such as Google Chrome, via a fake web page that mimics the Google Play Store. Once opened, the app seemingly innocently asks for accessibility permissions, which it then uses to take over your entire device.
RatHat uses the accessibility permissions users grant it to navigate your phone’s menu system and unlock Wireless Debugging, a legitimate developer tool commonly used in app testing, then grants itself ADB Shell permissions. This effectively grants the malware admin access to your device. Next, RatHat installs an AI-assisted agent that runs system commands to steal information and a proxy client that tunnels that stolen information back to the hacker.
“That sort of infection chain isn’t necessarily more complex than, say, following a phishing email on Windows and saying yes when the program asks for administrator permissions,” Sav Wheeler, a research engineer for Malwarebytes, said in an email. “Escalation in the Android landscape often relies on granting apps additional permissions that the OS locks away by default to keep the devices secure.”
Per Zimperium, the malware can be traced to attackers in China and primarily targets apps like WeChat Pay and Alipay, which are as popular in China as Apple Pay and Venmo are in the US. Malwarebytes notes that other financial apps can also be targeted. So far, researchers have found 162 infected apps in the wild, which report back to a dozen servers run by attackers.
What can this malware do?
The worrisome part is that the malware doesn’t do anything wonky the user would notice immediately, unlike with a ransomware attack. Instead, it bides its time, runs in the background, and captures information that appears on the screen, including usernames, passwords and two-factor authentication codes.
It can also steal raw touch input from your touchscreen, allowing it to recreate PIN codes and pattern unlock codes. It can capture SMS messages, too, thereby intercepting security codes. There isn’t much that the app can’t steal if it wants to.
How can I find out if I have RatHat on my phone?
Most folks are likely to never run into RatHat. You have to sideload a malicious app to do this, and so sticking to the Play Store prevents this entire problem.
A Google spokesperson confirmed to CNET in an email that Google Play Protect — which is enabled by default on Android devices with Google Play Services — already recognizes and protects against RatHat and that “no apps containing this malware are found on Google Play.”
The only other way to find it is to run an antivirus scan that detects the software. Malwarebytes on Google Play is a solid choice. It starts with a 14-day free trial of the pro version, which includes real-time protection. But even if you stick with the more limited free version after the 14-day trial, you can still run scans to catch malware. RatHat is publicly documented malware, so most other reputable Android antivirus apps should be able to find it as well.
The bad news is that RatHat is sneaky and difficult to quarantine.
“Unfortunately, because of the behavior of the program itself — remasquerading as other apps, dynamically changing its behavior using the AI endpoint — static analysis and quarantining is not enough to remove the malware,” Wheeler said.
In short, the only way to actually get rid of this malware is a complete factory reset of your device. This effectively removes the hidden secondary files the malware installs, which antivirus apps can’t deal with. Uninstalling the app doesn’t work because the malware retains its admin access through those hidden files, which then let it reinstall the app over and over again.
How do I avoid RatHat?
This is also good news. RatHat’s infection method is complex and can be thwarted at multiple points during the process. First, you should never click a link from an SMS or email from a source you don’t know or trust. That stops almost all social engineering threats right out of the gate, including RatHat. Verify that you’re using the official Google Play app rather than a deceptive imitation website. Look at the top of the screen. If it has an address bar where you type URLs, it’s just a website disguised as an app. Real apps do not have address bars.
Also, note that preinstalled or existing versions of Chrome do not require reinstallation, so if you’re being asked to reinstall an app you know you have, think twice.
Denying accessibility permissions is the critical final line of defense against mobile malware. While downloading a malicious application is risky, the software remains largely powerless until you grant it advanced system privileges.
Wheeler says that SMS phishing is targeted to each specific user, so you won’t see the same phishing attempt as another person, and the tactics the app uses vary from region to region. Following standard antiphishing practices and not enabling accessibility permissions largely removes the threat of RatHat.
