Researchers have identified a new Android malware family called RatHat. Both reports describe it as using an AI-powered component to help operators remotely navigate and control infected devices. According to The Hacker News, the malware is distributed primarily through targeted campaigns.
A notable feature is its abuse of Android Debug Bridge (ADB). RatHat uses ADB to maintain shell access on the device, allowing it to remain operational even after the app is uninstalled. This persistence mechanism is highlighted in both sources.
The two reports differ slightly on attribution. The Hacker News assesses that RatHat is operated by China-based threat actors, while BleepingComputer's coverage does not specify a threat actor. The malware's AI subsystem appears designed to automate device control, helping operators manage compromised devices remotely.