RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
-
RatHat operators are running their Android banking trojan through a web-based console, according to research from Cleafy. The console lets those behind the malware build and publish the trojan, as well as control infected phones remotely.
Cleafy has traced nearly 100 deployments of the console since April 2026. The security firm says this points to a malware-as-a-service setup, where each customer operates a separate copy of the console. The console also stores the data the malware collects from each infected device.
Source: The Hacker News
Has anyone in the community observed RatHat console infrastructure or similar Android banking trojan deployments in their environment?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login