Rat Hat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Summary: Cleafy traced nearly 100 deployments of a web console for the RatHat Android banking trojan since April 2026, run as malware-as-a-service with each customer operating a separate copy. The latest console version, one of three built from the same code between April and September 2026, asks Google's Gemini to estimate each victim's bank balance from stolen text messages and sorts phones into high-value and mid-value groups, though Cleafy found nothing in its samples using the model to move money.
Key Takeaway: The operators' scarce resource is attention, and Gemini is being used to spend it only on the phones worth opening - so a compromise that looks low-value to an attacker may simply mean the balance estimate came back small, not that the device is clean.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026