How to Spot and Block RatHat, the New Android Malware Stealing Bank PINs - CNET

A new Android malware strain called RatHat is spreading through fake download pages that mimic legitimate apps such as Google Chrome. Discovered by Zimperium, the attack tricks users into installing an app via a fake web page resembling the Google Play Store. After launch, RatHat requests accessibility permissions, then uses them to take over the device: it navigates the phone to enable Wireless Debugging, grants itself ADB Shell access, and installs an AI-assisted agent and proxy client to run system commands and exfiltrate data. Zimperium says targets include WeChat Pay and Alipay, with 162 infected apps found so far.