RatHat's dropper bypasses Android restricted settings through native SessionInstaller APIs

The generative AI calls are narrow. RatHat serializes the target device's live Accessibility tree to XML and talks to the assistant in Mandarin ^[13]. It asks for three things: the centre coordinates of a named on-screen target, returned as JSON, so the malware can direct synthetic clicks; the actual on-screen text of a target, read out of the XML without translation; and navigation signals such as SCROLL_DOWN ^[14]. The researchers did not name the assistant, and the report includes a graph pointing to Google's Gemini models ^[15].

Infosecurity Magazine's account of the analysis says RatHat leverages generative AI for operational control, and it also describes the AI tool's uses as non-malicious ^[20]. The calls listed are user-interface automation ^[14]. Command and control runs elsewhere: the Go agent fetches the FRP client's configuration from the C2 server ^[17], and the FRP client holds open the reverse tunnel to the device's ADB daemon ^[18]. If the assistant became unavailable, the operators would lose click targeting. The tunnel and the ADB access would remain ^[18].

For managed and BYOD fleets, the install step is the relevant part. Victims fetch the APK themselves, from phishing pages promoted through malvertising, smishing and third-party forums ^[5]. The dropper carries the payload in two encrypted assets ^[6] and uses native SessionInstaller APIs to get past Android's restricted settings and Accessibility Service protections. That installs the payload and gives it access to protected APIs ^[7].

The Go agent, liblocal-service.so ^[10], then runs its commands in the local ADB shell context to get around app-level restrictions ^[16]. It exempts the app from battery optimisation and Doze mode, prioritises its background execution, and can disable or uninstall other packages, security apps included ^[17]. On the app side, RatHat collects banking credentials, notifications, 2FA and OTP keys, and captures screen and inputs ^[11]. Four anti-analysis layers and one anti-debug layer sit in front of all of it, five in total ^[8][9].

"RatHat's multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient," the zLabs report said ^[19].

The published account does not include a victim count, the names of the apps being impersonated, or the banks targeted ^[21]. Attribution to China-based operators rests on the prompts seen in the zLabs investigation, which the researchers give as the main indicator ^[2][3].