New RatHat Android Malware Adds AI-Driven Remote Control

BleepingComputer reports the discovery of a new Android malware family dubbed RatHat, which includes an AI-powered subsystem that helps operators remotely navigate and control infected devices. Details on distribution methods, targeting, and attribution have not yet been fully disclosed in the initial reporting.

Why It Matters

Remote access trojans (RATs) on Android already give attackers hands-on control of a victim's device — access to messaging apps, banking sessions, camera, microphone, and stored credentials. Layering an AI subsystem on top to automate navigation lowers the skill and time required for an operator to act on a compromised device, potentially making mass exploitation of stolen access more efficient. Any Android user, particularly those who sideload apps or install from unofficial sources, could be at risk once more details on the delivery mechanism emerge.

What Defenders Should Watch For

• Monitor for anomalous accessibility-service usage on managed Android fleets, a common enabler for RAT-style remote control on the platform.
• Review mobile threat defense (MTD) and EMM/MDM alerts for newly installed apps requesting excessive permissions (accessibility, screen recording, device admin).
• Watch for unusual outbound network connections from mobile endpoints to unfamiliar C2 infrastructure, especially sustained low-and-slow beaconing consistent with automated remote-control sessions.
• Reinforce policies against sideloading APKs from outside official app stores, and ensure Play Protect or equivalent scanning is enabled on managed devices.

This is a developing story and technical details — including indicators of compromise, distribution vectors, and full capability analysis — are still emerging. We will track this item for updates. Read the original report at BleepingComputer.