Beware of Remote Phone Eavesdropping: Identifying a New Super Advanced Malware
Cyber threats against smartphone users are on the rise once again. Cybersecurity researchers from Zimperium have recently uncovered a new Android malware variant named ‘RatHat’, which is reportedly controlled directly by generative Artificial Intelligence (AI) technology.
Based on investigation reports, this malicious malware is strongly suspected to have been developed by threat actors from China.
What makes RatHat increasingly dangerous is its unusual capability. Instead of using rigid automation scripts like conventional malware, RatHat utilises generative AI to control the victim’s device in real-time.
“RatHat combines new techniques to maintain persistence on devices and leverages generative artificial intelligence for operational control,” stated the Zimperium zLabs research team, as quoted from Mashable on Wednesday (23/9/202<0xA0>26).
Modus Operandi: Disguising as Official Applications
Like most modern cybercrime activities, the spread of RatHat begins with social engineering tactics. Hackers deceive victims into downloading seemingly legitimate applications, such as Google Chrome, through fake websites designed to resemble the official Google Play Store.
Unknowingly, instead of downloading the original application, victims install the RatHat malware onto their devices.
Once installed, the fake application immediately requests accessibility permissions. Once permission is granted, the nightmare begins:
The malware automatically activates the Wireless Debugging feature within the Android Developer Options menu.
Through this loophole, RatHat provides the ‘control key’ to an AI assistant to navigate the phone screen, ranging from tapping and scrolling to executing commands autonomously.
Targeting Sensitive Data, Leading to Factory Resets
With full control in the hands of AI, hackers can freely intercept text messages (SMS), create fake window overlays on banking applications or digital wallets, and steal passwords and multi-factor authentication (MFA) codes.
Furthermore, the overlay feature also functions as a keylogger, recording every touch and keystroke made by the user directly on the device.
“RatHat uses AI to navigate and control the device interface intelligently and in real-time, making its operations more adaptive and harder to detect by security software compared to traditional script-based automation,” explained Zimperium.
Given the extreme level of threat, cybersecurity experts are urging Android users to be extra vigilant by not downloading applications arbitrarily from untrusted sources.
If a device has already fallen and been infected by RatHat, standard security software will be unable to clean it. The only absolute way out for victims is to perform a factory reset, which means all data on the phone will be completely lost.