Android Malware Steals Banking PINs, Reinstalls After Deletion

Key Takeaways

• A new Android banking malware, dubbed RatHat, is actively targeting users to steal banking PINs, passwords, and one-time verification codes.
• RatHat employs advanced persistence mechanisms, enabling it to reinstall itself and regain permissions even after a user attempts to delete the malicious application.
• The malware leverages Android’s Accessibility services and Wireless Debugging features to gain shell-level access and maintain remote control over infected devices.
• Attackers use deceptive phishing messages, malicious advertisements, and third-party forums to distribute the malware.
• Financial institutions and Android users should be vigilant for unusual permission requests and unexpected system activity.

New Android Malware Steals Banking PINs and Reinstalls Itself

A sophisticated new Android malware, identified as RatHat, is now actively exploiting mobile banking users through a combination of deceptive tactics, credential theft, and unparalleled persistence. This threat is designed to harvest sensitive information such as banking PINs, passwords, and unlock patterns, creating a significant risk of account takeover and unauthorized financial transactions. What makes RatHat particularly dangerous is its ability to reinstall itself and restore its malicious capabilities, even after victims believe they have successfully removed the application.

The campaign propagates through various social engineering vectors, including text-message phishing, malicious online advertisements, and compromised third-party forums. Victims are lured into downloading and installing an Android application package (APK) that masquerades as a legitimate utility. Once installed, the malware deceptively guides users into granting extensive Accessibility permissions, a technique also observed in recent campaigns like the ToxicPanda banking malware.

Security researchers at zLabs, part of Zimperium, first uncovered RatHat, linking its operations to actors believed to be based in China. Zimperium said in a report shared with Cyber Security News (CSN) that their analysis detailed an intricate infection chain that repurposes standard Android developer and accessibility functionalities into powerful tools for remote control and data exfiltration. The threat extends far beyond simply presenting fake login screens.

RatHat possesses the capability to monitor and log all on-screen activity, intercept SMS messages and notifications (crucial for capturing one-time verification codes), and collect a comprehensive list of installed applications. Its multi-faceted design provides attackers with numerous avenues to compromise bank accounts, while a covert component ensures sustained access to the device.

How RatHat Achieves Persistence and Control

Upon gaining Accessibility access, RatHat initiates an automated sequence of actions to enable Developer Options and Wireless Debugging on the compromised device. It then extracts the pairing code and dynamically changing port number provided by Android, subsequently establishing a pairing with the device’s local Android Debug Bridge (ADB) service. This critical step grants the malware shell-level access, a privilege typically restricted to developers and far beyond the scope of ordinary applications.

Following the acquisition of shell access, RatHat deploys two covert native components into a protected system directory. One component functions as a local agent (liblocal-service.so), capable of autonomously granting permissions, modifying background settings, and managing persistence. The second component (libmedia_codec.so) establishes a reverse connection, creating a persistent remote tunnel that exposes the device to the attackers. The abuse of Wireless Debugging for illicit purposes mirrors techniques seen in previous incidents, such as the RedHook ADB abuse case.

The most alarming characteristic of RatHat is its extraordinary resilience to removal. When a user attempts to uninstall the malicious application, RatHat can display a false uninstall failure screen, tricking the user into believing the process failed. Even if the visible application is successfully uninstalled, the local agent remains active outside the application’s normal lifecycle. This agent continuously monitors for the presence of the RatHat package (/data/local/tmp/app.apk). If it detects that the APK is missing, it will automatically reinstall the application and silently restore all necessary permissions, effectively reinstating the malware without further user interaction.

This robust persistence mechanism transforms a seemingly straightforward cleanup into a complex security incident. Users may delete the primary application, yet the attackers retain shell access and the ability to redeploy the malware at will. For organizations involved in mobile banking, any unexpected activation of Accessibility features or the appearance of Wireless Debugging prompts should be treated as a strong indicator of potential compromise.

AI Control Expands Fraud Risk

Beyond its persistence, RatHat employs sophisticated techniques for credential theft, including the use of fake web-based overlays designed to mimic legitimate banking, cryptocurrency, and payment applications. When a targeted financial app is launched, the malware overlays a convincing fake screen to capture login credentials and PINs. Furthermore, it monitors touch coordinates via the device’s input system, allowing it to infer PINs entered on a virtual keypad or the gestures used for pattern unlocks.

Researchers observed that RatHat transmits a live visual representation of the phone’s interface to a generative AI assistant. This AI is then utilized for specific automation tasks, such as identifying named buttons, extracting on-screen text, or determining when to scroll. This AI-driven approach enhances the malware’s adaptability, enabling it to function effectively across various screen layouts and languages, rather than relying on static tap locations. Similar remote-control capabilities have been documented in threats like StreamRAT.

What You Should Do

• Exercise Caution with App Downloads: Only download applications from official and trusted sources like the Google Play Store. Avoid installing apps from links received in unsolicited messages, suspicious advertisements, or unverified third-party forums.
• Scrutinize Permissions: Be extremely wary of applications requesting Accessibility service permissions, especially if the app’s function does not logically require such extensive access. Review and understand all permissions an app requests before granting them.
• Monitor Device Settings: Regularly check your Android device’s “Accessibility” settings for any unfamiliar services enabled. Additionally, inspect “Developer Options” to ensure “Wireless Debugging” is disabled unless you are an active developer and understand the risks. Unexpected activation of these settings is a critical red flag.
• Verify Financial Activity: If you notice unusual prompts, suspicious login screens, or unexplained activity in your banking or payment applications, immediately contact your financial institution using a trusted phone number or through their official website on a separate, secure device.
• Strengthen Authentication: Avoid relying solely on SMS-based one-time codes for authentication, as RatHat is specifically designed to intercept these. Whenever possible, enable stronger multi-factor authentication methods such as authenticator apps or hardware security keys.
• Stay Informed: Keep your Android operating system and all applications updated to the latest versions to benefit from the most recent security patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.