RatHat can steal Android PINs, but the documented attack needs extensive access

According to Zimperium, RatHat can collect banking credentials, authentication codes and Android unlock secrets, but the available evidence does not describe automatic theft from a phone without prior interaction. The attack chain analysed by the company starts with a user sideloading a malicious Android package and granting it Accessibility access.

That distinction matters as headlines about the malware reach a wider audience. Zimperium publicly disclosed its RatHat analysis on 16 September 2026. Fox News published renewed coverage on 2 October, but that later article did not mark the original public disclosure.

Once the required access is established, the reported capabilities include credential collection and shell-level persistence. The prerequisites make this a social engineering and permission-abuse chain, not a reported zero-click attack or a threat presented as an Android vulnerability fixed by a security update. The reviewed sources do not establish how many people completed the infection sequence.

Installation and permissions come first

Zimperium says RatHat is primarily delivered through smishing, malicious advertising, deceptive phishing sites and third-party forums. These routes attempt to persuade a user to download and install an Android package from outside an official store.

In the chain analysed by Zimperium, Accessibility access is pivotal. RatHat reportedly abuses it to automate changes to Developer Options and Wireless Debugging, then obtains the information needed to pair with the phone’s local Android Debug Bridge service.

That local connection allows the malware to stage additional components with shell-level capabilities outside the ordinary application process. Zimperium identified a Go-based command agent and a reverse-proxy client in the analysed samples. This deeper access supports remote control and helps explain why removing only the visible application may not remove every malicious component.

The sequence contains several points where it can be interrupted. RatHat does not gain the reported capabilities merely because someone receives a text message, views an advert or visits a website. Installation and significant permission abuse must occur first in the documented chain.

How RatHat obtains credentials

Zimperium says RatHat uses several collection methods after compromise. It can display fraudulent overlays that imitate legitimate applications, intercept SMS messages and notifications, and collect raw touch coordinates. By comparing those coordinates with stored device layouts, the malware can reconstruct a PIN or Android unlock pattern.

These mechanisms also clarify the role of artificial intelligence in the research. Zimperium describes a generative AI component that receives information from the Accessibility tree, identifies interface elements, interprets displayed text and helps direct navigation through the device.

In the analysed workflow, the AI component is an interface automation aid. It is not described as directly reading PINs. Credential collection instead relies on overlays, intercepted communications and analysis of where the user touches the screen. Zimperium did not identify the AI model or service in its original analysis.

What Google’s protection claim covers

Google told BleepingComputer that no applications containing RatHat had been found on Google Play under its then-current detection, and that Play Protect protected users against known versions. The reviewed evidence therefore does not show that the documented samples were distributed through Google Play.

Google’s statement is narrower than a guarantee of universal protection. It concerns known versions and does not establish how detection would perform against every modified or future sample. No public detection-efficacy data was available in the reviewed material.

The absence of a published affected-version range is another important limitation. Zimperium did not identify particular Android releases or device models as affected or unaffected. RatHat is presented as a malicious application and permission-abuse chain, not evidence that every Android device is vulnerable or compromised.

Prevention and recovery

Malwarebytes advises users to avoid off-store APK files, scrutinise unexpected Accessibility requests and keep Wireless Debugging disabled when it is not needed. Users can also review existing Accessibility grants and remove access from unrecognised or unnecessary applications. Google Play Protect should remain enabled, with the qualification that Google’s RatHat statement covers known versions.

Recovery may require more than uninstalling the visible application. Zimperium reports that RatHat’s shell-level service can remain after the application is removed, reinstall it and restore its permissions. Malwarebytes consequently advises performing a factory reset when RatHat infection is confirmed.

That recommendation is consistent with the persistence mechanism Zimperium described, but it remains attributed guidance rather than a universally proven requirement for every Android device. The reviewed material contains no independent study across Android versions and manufacturers showing that a factory reset is always necessary or sufficient.

The evidence supports a warning about what RatHat can do after a substantial compromise, not claims of a widespread outbreak. The public sources provide no confirmed victim count, financial loss, named compromised organisation, affected Android version range or Australian campaign. Its reported delivery routes are accessible internationally, but that potential relevance should not be mistaken for evidence of Australian targeting. The essential distinction remains between RatHat’s eventual capability and the steps required to reach it: a sideloaded application, an Accessibility grant and abused debugging access all precede the reported credential theft.

Treating permissions as part of the story, rather than fine print, helps place later malware capabilities in their proper context. The Hack Academy invites you to continue your learning through our online cybersecurity training programme, with self-paced study in cybersecurity fundamentals and networking, plus practical exercises alongside theory.