RatHat does not exploit a vulnerability in Android. It asks permission, and the permission it asks for is the one that lets it do everything else.
Mobile security firm Zimperium found it, and the chain is worth following step by step because every link is a documented feature. CNET has the details: a fake page imitating the Google Play Store serves an app that looks legitimate, often presented as Google Chrome. On first run it requests accessibility permissions, which sound benign and are not.
Accessibility to developer tool to shell
With accessibility granted, the malware can read the screen and drive the interface. It uses that to walk through the phone's own settings menus and switch on Wireless Debugging, a real developer feature used for app testing, then grants itself ADB Shell permissions through it.
At that point it has administrator-level control of the device. It installs two things: an AI-assisted agent that runs system commands to collect information, and a proxy client that tunnels the results back to the operator.
Sav Wheeler, a research engineer at Malwarebytes, put the sophistication in perspective. "That sort of infection chain isn't necessarily more complex than, say, following a phishing email on Windows and saying yes when the program asks for administrator permissions," he said. Escalation on Android, he added, usually comes down to persuading the user to grant an app the permissions the operating system withholds by default precisely to keep the device secure.
That is the honest read. Nothing here is a novel exploit. It is a well-built social engineering chain that converts one careless tap into full device control, using only capabilities Android ships with.
What it takes and why you would not notice
The theft is comprehensive. Running quietly in the background, RatHat captures whatever appears on screen, which means usernames, passwords and two-factor codes as they are displayed.
It also reads raw touch input, which is how it reconstructs PIN codes and pattern unlocks that never appear on screen at all. It intercepts SMS, so codes delivered by text are collected too. Between screen capture, touch capture and message interception there is very little left that it cannot take.
The absence of symptoms is the design. Ransomware announces itself because it has to. This does the opposite and waits, which means the window between infection and discovery is however long the operator wants it to be.
Zimperium traces the operation to attackers in China, with WeChat Pay and Alipay as the primary targets, apps that occupy roughly the position Apple Pay and Venmo do in the United States. Malwarebytes notes other financial apps can be targeted as well. Researchers have found 162 infected apps in circulation so far, reporting back to about a dozen attacker-run servers.
The defence is boring and it works
There is no patch for this because there is no bug. The protections are behavioural and they are the same ones that have applied for years.
Install from the Play Store, reached through the Play Store app rather than a link. A page that looks like the Play Store in a browser is not the Play Store. Treat any accessibility permission request as a serious decision, because a legitimate app that genuinely needs it is rare and will be a screen reader or an automation tool, not a browser. Check Settings for accessibility services you do not recognise, and for Wireless Debugging being switched on when you did not switch it on.
The 162 figure is the one to keep in mind. This is not a single app to avoid, it is a distribution operation with many fronts, which means recognising the request matters more than recognising the name.
State-backed operations have been running comparable playbooks against developers specifically, including malware hidden in coding tests that reached 30,000 machines. The AI-assisted component here also fits a wider pattern of unmanaged automation showing up inside systems nobody is watching, which Cisco has said is already happening on most corporate networks.