{
    "success": true,
    "data": {
        "id": 1997177,
        "msgid": "beware-of-remote-phone-eavesdropping-identifying-a-new-super-advanced-malware-1790157452",
        "date": "2026-09-23 16:00:00",
        "title": "Beware of Remote Phone Eavesdropping: Identifying a New Super Advanced Malware",
        "author": "",
        "source": "CNBC",
        "tags": "",
        "topic": "Technology",
        "summary": "Cybersecurity researchers have uncovered 'RatHat', a sophisticated new Android malware that utilises generative Artificial Intelligence to control devices in real-time. The malware, suspected to be developed by Chinese threat actors, can bypass traditional security measures by mimicking user interactions through AI-driven automation.",
        "content": "<p>Cyber threats against smartphone users are on the rise once again.\nCybersecurity researchers from Zimperium have recently uncovered a new\nAndroid malware variant named \u2018RatHat\u2019, which is reportedly controlled\ndirectly by generative Artificial Intelligence (AI) technology.<\/p>\n<p>Based on investigation reports, this malicious malware is strongly\nsuspected to have been developed by threat actors from China.<\/p>\n<p>What makes RatHat increasingly dangerous is its unusual capability.\nInstead of using rigid automation scripts like conventional malware,\nRatHat utilises generative AI to control the victim\u2019s device in\nreal-time.<\/p>\n<p>\u201cRatHat combines new techniques to maintain persistence on devices\nand leverages generative artificial intelligence for operational\ncontrol,\u201d stated the Zimperium zLabs research team, as quoted from\nMashable on Wednesday (23\/9\/202&lt;0xA0&gt;26).<\/p>\n<p>Modus Operandi: Disguising as Official Applications<\/p>\n<p>Like most modern cybercrime activities, the spread of RatHat begins\nwith social engineering tactics. Hackers deceive victims into\ndownloading seemingly legitimate applications, such as Google Chrome,\nthrough fake websites designed to resemble the official Google Play\nStore.<\/p>\n<p>Unknowingly, instead of downloading the original application, victims\ninstall the RatHat malware onto their devices.<\/p>\n<p>Once installed, the fake application immediately requests\naccessibility permissions. Once permission is granted, the nightmare\nbegins:<\/p>\n<ul>\n<li><p>The malware automatically activates the Wireless Debugging\nfeature within the Android Developer Options menu.<\/p><\/li>\n<li><p>Through this loophole, RatHat provides the \u2018control key\u2019 to an AI\nassistant to navigate the phone screen, ranging from tapping and\nscrolling to executing commands autonomously.<\/p><\/li>\n<\/ul>\n<p>Targeting Sensitive Data, Leading to Factory Resets<\/p>\n<p>With full control in the hands of AI, hackers can freely intercept\ntext messages (SMS), create fake window overlays on banking applications\nor digital wallets, and steal passwords and multi-factor authentication\n(MFA) codes.<\/p>\n<p>Furthermore, the overlay feature also functions as a keylogger,\nrecording every touch and keystroke made by the user directly on the\ndevice.<\/p>\n<p>\u201cRatHat uses AI to navigate and control the device interface\nintelligently and in real-time, making its operations more adaptive and\nharder to detect by security software compared to traditional\nscript-based automation,\u201d explained Zimperium.<\/p>\n<p>Given the extreme level of threat, cybersecurity experts are urging\nAndroid users to be extra vigilant by not downloading applications\narbitrarily from untrusted sources.<\/p>\n<p>If a device has already fallen and been infected by RatHat, standard\nsecurity software will be unable to clean it. The only absolute way out\nfor victims is to perform a factory reset, which means all data on the\nphone will be completely lost.<\/p>",
        "url": "https:\/\/jawawa.id\/newsitem\/beware-of-remote-phone-eavesdropping-identifying-a-new-super-advanced-malware-1790157452",
        "image": ""
    },
    "sponsor": "Okusi Associates",
    "sponsor_url": "https:\/\/okusiassociates.com"
}