Zimperium researchers have documented a new Android implant called RatHat that they assess is run by China-based operators. Its distinguishing feature is not the credential theft, which is familiar, but the machinery it uses to get away with it.
RatHat spreads through smishing messages, malvertising and third-party forums that funnel users to fake download portals. The installed package acts as a dropper, hiding its payload in two encrypted files. Each is decoded with the same routine: skip a 24-byte header, read the length, apply an XOR and subtraction step byte by byte, then gunzip. The second stage loads a DEX file directly into memory.
From there the malware pairs with the phone’s own Android Debug Bridge, the debugging interface meant for developers. The researchers describe autonomous local ADB self-pairing combined with Accessibility abuse, which breaks out of the normal application sandbox and stages native daemons running with shell-level privileges. A Go agent pulls tunnel configuration from command-and-control and opens a reverse tunnel, giving operators a general-purpose road into the handset.
The payload list is broad: SMS messages, credentials, files, the lock screen PIN, pattern or password, screen captures, keystrokes typed into browser address bars, and installed applications. A hardware-level keylogger records finger presses on the screen.
Zimperium’s conclusion is that multi-tiered architecture, out-of-lifecycle daemons and live generative AI decision loops defeat signature-based mobile controls. The practical answer is to stop sideloaded APKs from reaching enterprise devices at all.
