<![CDATA[RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims]]>

<![CDATA[RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims]]>RatHat operators are running their Android banking trojan through a web-based console, according to research from Cleafy. The console lets those behind the malware build and publish the trojan, as well as control infected phones remotely.

Cleafy has traced nearly 100 deployments of the console since April 2026. The security firm says this points to a malware-as-a-service setup, where each customer operates a separate copy of the console. The console also stores the data the malware collects from each infected device.

Source: The Hacker News

Has anyone in the community observed RatHat console infrastructure or similar Android banking trojan deployments in their environment?

]]>https://xploitlk.com/topic/566/rathat-android-malware-console-uses-gemini-to-identify-higher-value-victimsRSS for NodeTue, 27 Oct 2026 07:48:55 GMTSun, 04 Oct 2026 16:30:21 GMT60