RatHat Android Malware Uses Generative AI to Control Devices

Forensic Summary

RatHat is a sophisticated Android RAT attributed to China-based threat actors that abuses Android Debug Bridge (ADB) to maintain persistent shell access even after the malware is uninstalled. Notably, the malware integrates a generative AI assistant to parse on-screen accessibility trees and autonomously direct device interactions, representing an emerging class of AI-augmented mobile threats. Its layered anti-analysis techniques and persistence mechanisms make it a significant threat to Android users targeted via smishing and malvertising campaigns.

---

Read the full technical deep-dive on Grid the Grey: https://gridthegrey.com/posts/rathat-android-malware-uses-generative-ai-to-control-devices/