Security researchers at Zimperium have uncovered a new Android malware strain they’ve named RedHat linked to threat actors believed to be operating from China that targets banking credentials, 2FA and OTP codes, notifications, and other sensitive data while providing persistent remote access to compromised devices. RatHat is distributed through smishing, malvertising, malicious websites, and third-party forums, where victims are tricked into installing malicious APKs disguised as legitimate applications. A dropper abuses Android SessionInstaller APIs to bypass restricted settings and Accessibility Service protections, while multiple anti-analysis and anti-debugging layers hinder detection. The malware uses a three-part architecture consisting of a malicious Android application, a Go-based command-and-control agent, and an FRP client that creates a persistent reverse tunnel to the attacker and exposes access to the device’s ADB daemon. Notably, RatHat incorporates generative AI into its UI-automation process, sending device Accessibility-tree data to an AI assistant (potentially Google Gemini) to identify interface elements and direct automated clicks, scrolling, and navigation. The malware can also capture screens and user input, maintain background execution, disable or uninstall security applications, and execute arbitrary commands, giving operators extensive surveillance and control capabilities beyond traditional mobile credential theft. CTIX analysts will continue to report on novel and interesting malware in the future.