RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Overview
A new Android banking trojan called RatHat is being controlled through a web console used by its operators to manage infected devices. Security firm Cleafy has identified nearly 100 instances of this console being deployed since April 2026. This malware operates on a malware-as-a-service model, allowing different customers to run their own versions of the trojan. The console collects various data from compromised phones, which can include sensitive financial information. The use of this malware poses significant risks to users, particularly those with banking applications on their Android devices, as attackers can steal personal and financial information with relative ease.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Android banking applications, mobile devices
- Action Required: Users should ensure their devices have up-to-date security software, avoid downloading apps from untrusted sources, and regularly monitor their banking activity for unauthorized transactions.
- Timeline: Ongoing since April 2026
Original Article Summary
RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone,
Impact
Android banking applications, mobile devices
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since April 2026
Remediation
Users should ensure their devices have up-to-date security software, avoid downloading apps from untrusted sources, and regularly monitor their banking activity for unauthorized transactions.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Android, Google, Malware, and 1 more.