🔴 RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation.

The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs, one-time passwords, device-unlock secrets, and other high-value data from infected Android devices.

In one analyzed build, the malware could impersonate a well-known streaming service and dynamically alter its visible icon and app label, including use of a “Chrome” activity alias.