{"id":51325,"date":"2026-09-18T10:15:50","date_gmt":"2026-09-18T10:15:50","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=51325"},"modified":"2026-09-18T10:15:50","modified_gmt":"2026-09-18T10:15:50","slug":"new-android-malware-uses-ai-to-steal-banking-logins-and-control-phones-report","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=51325","title":{"rendered":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report"},"content":{"rendered":"

\"\"<\/p>\n

A newly uncovered Android malware strain is using artificial intelligence to take over infected phones and steal banking credentials.<\/p>\n

Zimperium\u2019s zLabs team says<\/a> the malware, called RatHat, appears linked to threat actors that appear to be operating in China and spreads through smishing and malvertising that push malicious APK downloads outside Google Play.<\/p>\n

Once installed, RatHat abuses Accessibility permissions to turn on Developer Options and Wireless Debugging, then pairs with the device\u2019s own ADB service to break out of the normal app sandbox.<\/p>\n

It deploys Go-based agents for shell commands and a persistent reverse tunnel back to attackers, while showing fake HTML overlays on banking and crypto apps to capture logins and intercept SMS one-time codes.<\/p>\n

\u201cRatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.<\/em><\/p>\n

The malware also monitors raw touch input to reconstruct PINs, passwords and unlock patterns, and can reinstall itself through a hidden background service if a victim tries to remove the main app.<\/p>\n

Researchers say RatHat packs several anti-analysis tricks, including a bloated 61MB Android manifest and poisoned DEX bytecode meant to break security tools.<\/p>\n

Follow us on X<\/a>, Facebook<\/a> and Telegram<\/a><\/span><\/em>
\n
\nDon’t Miss a Beat \u2013 Subscribe<\/a> to get email alerts delivered directly to your inbox <\/span><\/em>
\n<\/p>\n

\n
<\/div>\n

&nbsp<\/p>\n

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.<\/h6>\n<\/div>\n

Featured Image: Shutterstock\/A. Solano<\/em><\/span><\/p>\n

The post New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report<\/a> appeared first on The Daily Hodl<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

A newly uncovered Android malware strain is using artificial intelligence to take over infected phones and steal banking credentials. Zimperium\u2019s zLabs team says the malware, called RatHat, appears linked to threat actors that appear to be operating in China and spreads through smishing and malvertising that push malicious APK downloads outside Google Play. Once installed, […]<\/p>\n","protected":false},"author":1,"featured_media":51326,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"class_list":["post-51325","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\nNew Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=51325\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"A newly uncovered Android malware strain is using artificial intelligence to take over infected phones and steal banking credentials. Zimperium\u2019s zLabs team says the malware, called RatHat, appears linked to threat actors that appear to be operating in China and spreads through smishing and malvertising that push malicious APK downloads outside Google Play. Once installed, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=51325\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-18T10:15:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dailyhodl.com\/wp-content\/uploads\/2022\/09\/web3-metaverse-projects-attracted.jpg?resize=1024,600\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report\",\"datePublished\":\"2026-09-18T10:15:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325\"},\"wordCount\":347,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/web3-metaverse-projects-attracted-SiKN3A.webp\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325\",\"name\":\"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/web3-metaverse-projects-attracted-SiKN3A.webp\",\"datePublished\":\"2026-09-18T10:15:50+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=51325\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/web3-metaverse-projects-attracted-SiKN3A.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/web3-metaverse-projects-attracted-SiKN3A.webp\",\"width\":1024,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51325#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=51325","og_locale":"en_US","og_type":"article","og_title":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag","og_description":"A newly uncovered Android malware strain is using artificial intelligence to take over infected phones and steal banking credentials. Zimperium\u2019s zLabs team says the malware, called RatHat, appears linked to threat actors that appear to be operating in China and spreads through smishing and malvertising that push malicious APK downloads outside Google Play. Once installed, […]","og_url":"https:\/\/cryptomag.finance\/?p=51325","og_site_name":"Cryptomag","article_published_time":"2026-09-18T10:15:50+00:00","og_image":[{"url":"https:\/\/dailyhodl.com\/wp-content\/uploads\/2022\/09\/web3-metaverse-projects-attracted.jpg?resize=1024,600","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=51325#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=51325"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report","datePublished":"2026-09-18T10:15:50+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=51325"},"wordCount":347,"image":{"@id":"https:\/\/cryptomag.finance\/?p=51325#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/web3-metaverse-projects-attracted-SiKN3A.webp","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=51325","url":"https:\/\/cryptomag.finance\/?p=51325","name":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=51325#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=51325#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/web3-metaverse-projects-attracted-SiKN3A.webp","datePublished":"2026-09-18T10:15:50+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=51325#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=51325"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=51325#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/web3-metaverse-projects-attracted-SiKN3A.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/web3-metaverse-projects-attracted-SiKN3A.webp","width":1024,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=51325#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/51325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=51325"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/51325\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/51326"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=51325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=51325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}