RATHat: The Android Banking Trojan That Pairs With Its Own ADB and Asks AI Where to Tap

What RATHat is

Threat reseachers disclosed RATHat on 16 September 2026, and  followed on 28 September with an analysis of its operator console. It is rented out as a service. Each customer gets a separate web console to build, sign and distribute the malware and to control infected phones. Cleafy counted nearly 100 console deployments since April 2026.

Distribution is simple: targeted smishing and malvertising that lead to fake download portals. Earlier campaigns used a StripChat-themed decoy. The sophistication starts after installation.

Escaping the sandbox without an exploit

Most Android banking trojans are limited to the permissions the user grants them. RATHat uses those permissions to get more. With Accessibility it can press any button a user can, so it walks through Settings, taps the build number to unlock Developer Options, and turns on Wireless Debugging.

Wireless Debugging normally pairs a phone with a developer's computer using a six-digit code shown on screen. RATHat reads that code and the dynamic port from the screen, then authenticates to the phone's own ADB daemon through an embedded libadb-android library. No computer, no vulnerability and no root are needed. The result is a shell running as Android's shell user (UID 2000), the same identity a developer gets over USB. From there it can install packages, change secure settings and read input devices that an ordinary app cannot reach.

"...local ADB (Android Debug Bridge) self-pairing to break out of the standard Android application sandbox."

Persistence: two Go binaries and a tunnel

Once the shell is in place, RATHat stages its long-lived components. Both are written in Go and named to look like ordinary native libraries.

The agent runs outside the app's package lifecycle, so uninstalling the app does not stop it. It can put the app back with pm install -r -g -i com.android.packageinstaller /data/local/tmp/app.apk and restore Accessibility with settings put secure. Zimperium notes that the heartbeat restarting the agent depends on the app, so it is still unclear whether the foothold survives a reboot after removal.

What it steals, and how

• Overlays: HTML phishing screens drawn over banking and payment apps, including WeChat and Alipay, to capture logins.
• SMS and OTPs: incoming text messages, including one-time passcodes, are forwarded to the operator.
• Accessibility text capture: typed text is rebuilt from Accessibility events.
• Touch logging: the Go agent runs getevent on /dev/input to record raw touch coordinates, then maps them to PINs and unlock patterns using per-brand keypad layouts in locateValues.json.
• Remote control: minicap and minitouch stream the screen and inject taps with no permission prompt and no recording indicator on Android 13 and earlier. screencap at about 5 fps and standard MediaProjection are the fallbacks.

Where the AI comes in

RATHat uses a large language model in two places. Neither one moves money.

1. On the phone: a navigation fallback

Settings screens differ across Android versions and OEM skins, which breaks hard-coded tap sequences. When that happens, RATHat serialises the live Accessibility tree to XML and sends it, with Mandarin prompts, to a generative AI model. The model returns JSON with coordinates and actions such as tap or SCROLL_DOWN, for example to find the "Pair device with pairing code" button. Cleafy found the model is used mainly to keep the Wireless Debugging setup working, with the API key stored in the app's settings.

2. In the console: victim triage

According to Cleafy, the latest console supports only Google Gemini and sends operators to Google AI Studio for a key. It feeds stolen SMS to the model to estimate each victim's bank balance and sorts phones into high-value and mid-value groups, so operators know whom to work first. Nothing in the analysed samples uses the model to transfer funds.

The ADB self-pairing is what makes RATHat dangerous. The model adds reliability, letting one build work across many phone models, and saves operators time when choosing targets.

The operator console

Every RATHat customer runs a separate console. Cleafy describes it as a complete build tool: operators create and sign builds, schedule rebuilds that change file hashes, and publish to Amazon S3 or their own servers. The panel has been rebranded several times.

Live consoles serve an HTTPS panel titled 熊猫工坊-旗舰版V5, 熊猫工坊-旗舰版V6 ("Panda Workshop, Flagship Edition") or PandaV6. Public scan data shows the same hosts running an FRP server on TCP 7000, which is where the tunnels opened by libmedia_codec.so terminate. Console domains follow a consistent pattern: admin. subdomains of cheap TLDs, registered in bulk at NameSilo, many of them hosted on BGPNET (AS4907, Singapore).

The brand is older than the reporting. rathat[.]me and rathat[.]org were registered in the same second on 8 September 2024, and passive DNS shows admin.rathat[.]live resolving by November 2024. The Internet Archive holds a capture of the rathat[.]live panel from July 2025, and in January 2026 its /api/version endpoint reported V2.0.

What the old panel domain serves now

As of 29 September 2026, admin.rathat[.]live no longer shows a console. It serves a Chinese government welfare themed download page, "畅聊民生" (roughly "Chat About People's Livelihood"), advertising elderly care, social security and healthcare services. The page redirects to yzbwiosod.hucuwa[.]cn/clms.bin, which delivers a 68 MB APK.

That APK is not RATHat. It is a chat app built on a commercial messaging SDK, with a wallet, group "red packets", withdrawals and a PhoneIntercepterService backed by call-handling permissions. The feature set matches Chinese telecom-fraud apps that keep victims in scripted chat groups and can intercept calls to banks or police. Each download is repackaged with a new package name, a new hash and a deliberately invalid ZIP header.

The link to RATHat is the server rather than the code. The same host, 165.154.203[.]196, served accessibility.rathat[.]club, api.rathat[.]club and download.rathat[.]club in March 2026. This points to one operation, or one infrastructure provider, running both a banking trojan and a fraud chat app. Whether the chat app can deliver RATHat as a second stage has not been confirmed.

Who is behind it?

"...threat actors that appear to be operating in China."

No public source names the developer or the operators. The indicators are Mandarin prompts, a Chinese-language panel, pinyin domain names (xiongmao "panda", cunzhang "village chief", jiaozhu "cult leader") and WeChat and Alipay targeting. Together they describe a Chinese-speaking operation, not a specific group or location. There is no verified link to PlayPraetor, SpyNote, GoldFactory or other Chinese-speaking Android MaaS families.

The infrastructure suggests a central developer. Brand domains and console domains are registered in batches seconds apart, hosting is uniform, and every console carries the same FRP setup. That fits one provider building panels for many paying customers.

Detection and response

• Device: look for processes running as UID 2000 outside a developer session, and for liblocal-service.so, libmedia_codec.so, app.apk, minicap or minitouch in /data/local/tmp.
• Network: alert on device traffic to TCP 7000 on unfamiliar hosts and on WebSocket traffic to admin.* subdomains of low-cost TLDs. Block the indicators below.
• MDM and enterprise: flag devices with Wireless Debugging or Developer Options enabled, and sideloaded apps holding Accessibility.
• Users: do not install apps from links in texts or ads, and treat any app asking for Accessibility with suspicion.

Indicators of compromise

Zimperium's repository [2] lists published C2 endpoints, distribution URLs and 161 APK SHA-256 hashes. The console domains in the first table below do not appear in published IOC lists. "Confirmed" means public scan data shows the Panda Workshop panel or FRPS on port 7000. "Candidate" means the registration batch and hosting match, but content was not observed.

Panda Workshop consoles

Published by Cleafy

RATHat brand infrastructure and current lure

# Brand domains (GoDaddy, registered in batches)
rathat[.]me  rathat[.]org  rathat[.]live  rathat[.]cloud  rathat[.]club
accessibility.rathat[.]club  api.rathat[.]club  download.rathat[.]club
admin.rathat[.]cloud  api.rathat[.]live
# Server hosting the panel domain and the current lure
165.154.203[.]196    7088603[.]cc
# Fraud chat app delivery (served from admin.rathat[.]live)
hxxps://yzbwiosod.hucuwa[.]cn/clms.bin
# Repackaged per download. Stable markers:
com.ddtx.dingdatacontact.*
com.CjftvKAgfmYMVk.PSkDqSVbrrhoGb.*
OpenInstall key ghbfm3

Network ranges and host artifacts

# Console hosting observed, AS4907 BGPNET PTE LTD
186.240.199.0/24   186.240.200.0/24   186.240.201.0/24
# On-device
/data/local/tmp/liblocal-service.so
/data/local/tmp/libmedia_codec.so
/data/local/tmp/app.apk

Blocking whole /24 ranges at a hosting provider can affect unrelated customers, so evaluate before deploying. This infrastructure rotates quickly, and several domains had stopped resolving at the time of writing.

Verdict