RatHat Android Trojan Uses AI to Control Devices: How AI-Powered Malware Threatens Android Users

0:00Welcome to today's cybersecurity update. My name is John Luca. Visit my website www.oscentinvestigate.com. A new Android Trojan called Radhat is drawing attention because it combines traditional mobile malware techniques with generative artificial intelligence. According to Security Week, citing mobile security companies Imperium, Radhat can use AI to navigate and control an infected Android device in real time. This makes the malware particularly interesting because artificial intelligence is not simply being used by the attackers as a development tool. It is incorporated into the malware's operational workflow. So how does Radhat work? The infection can begin through smishing messages or malicious advertising. A dropper then launches a multi-stage infection process designed to bypass Android security restrictions and ultimately obtain shell-level execution. Once installed, Radhat can request powerful permissions and abuse Android accessibility services. It can capture the screen, monitor user input,

1:03intercept SMS messages, and display fake interfaces designed to imitate banking and payment applications. The objective is clear. Steal sensitive information such as usernames, passwords, pins, authentication codes, and other credentials. But one of Radhat's most unusual capabilities involves generative AI. The malware can serialize the device's accessibility tree into XML and provide that information to an AI assistant. The AI can then interpret what is displayed on the screen and determine how to navigate and interact with the device. In practical terms, this means the malware can potentially understand the structure of an interface and automate interactions dynamically rather than relying exclusively on fixed coordinates or predefined sequences. Radhat also has several mechanisms for monitoring what the victim enters. It can use accessibility events, identify text and browser address bars, and even monitor hardware-level touch events. Its go-based agent can use Android's get-event utility to obtain raw touchscreen coordinates.

2:08These coordinates can then be compared with the layout of a keypad, potentially allowing the malware to reconstruct pins and other input. Persistence is another major concern. Radhat can establish administrator-level privileges, deploy a hidden background service, and maintain remote access through a reverse proxy component. It can also interfere with attempts to uninstall the malware. According to the reported analysis, even after the main application is removed, its shell service can remain active and attempt to reinstall the malware. The architecture reportedly includes three major components. The malicious Android application, a go-based agent responsible for command, execution, and persistence, and an FRP-based reverse proxy client that provides attackers with a persistent tunnel to the device. Security Week also reports that the AI prompts observed in the malware suggest a possible connection to a Chinese-speaking threat actor, although attribution should be treated cautiously. What makes Radhat significant is therefore not simply the list of functions it possesses.

3:12The important development is the combination of malware automation, real-time interface understanding, credential theft, persistence, and AI-assisted interaction. For Android users, the practical lesson remains straightforward. Avoid installing applications from untrusted sources, be extremely cautious with links received through SMS or unexpected advertisements, and carefully review requests for accessibility services or device administrator privileges. For security professionals, Radhat illustrates a broader challenge. As generative AI becomes more capable of interpreting interfaces and automating tasks, malicious software can potentially use the same capabilities to become more adaptive. The battle between artificial intelligence and cybersecurity is no longer only about how defenders use AI. Malware developers are experimenting with it, too, and Radhat could be an early example of what that future looks like.