Executive Summary
RatHat, China-linked Android malware with an AI-powered system to navigate infected devices, abuses ADB to keep shell access after uninstall.
What Happened
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
Affected Products
- Android
Vulnerability / Attack Technique
AI-driven mobile malware
Technical Mechanism
AI automates device control; ADB gives persistence.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
AI automation in mobile malware.
Recommended Controls
- Disable USB debugging
- Block sideloading
Related RealGround Service
AI CISO Advisory · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.