Executive Summary
Cleafy says the RatHat Android banking trojan's malware-as-a-service console, seen in nearly 100 deployments, uses Gemini to identify higher-value victims.
What Happened
RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone,
Affected Products
- Android
- Google Gemini
Vulnerability / Attack Technique
AI used to prioritize fraud victims
Technical Mechanism
The console sends collected data to an LLM to rank victims.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
Criminals use AI to triage stolen data. RealGround analysis: AI makes fraud operations more efficient, not more novel.
Recommended Controls
- Block sideloading on managed devices
Related RealGround Service
AI CISO Advisory · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.