Zero News | AI Is Guessing Your Bank Balance: The RatHat Android Banking Trojan

Security firm Cleafy has exposed the infrastructure behind RatHat, an Android banking trojan sold as malware-as-a-service.

Since April 2026, Cleafy has identified nearly 100 separate control panels used by attackers to manage infected phones across Europe, Latin America and Southeast Asia.

How RatHat Spreads

The malware reaches victims through fake text messages (smishing), malicious ads and fake download pages.

Once installed and granted Accessibility permission, RatHat turns on developer options and wireless debugging by itself to open a hidden control channel on the phone.

The AI Twist

The attackers' console sends the SMS messages stolen from each phone to Google's Gemini model and asks it to estimate the victim's bank balance.

Phones are then sorted into "high-value" and "mid-value" groups, so criminals can focus on the victims with the most money.

If AI can read your text messages and guess your balance, how would you know your phone is being watched?

Fake Screens, Real Losses

RatHat overlays banking apps with fake login screens that are nearly impossible to tell apart from the real ones, stealing passwords and SMS verification codes.

According to Cleafy, the AI does not move the money itself, but it makes choosing targets and controlling devices far easier for fraudsters.

Recommended Actions

• Install apps only from Google Play and never install APK files received via SMS, ads or web links.

• Do not grant Accessibility permission to any app without a clear reason; remove unknown apps that request it.

• If Developer Options or Wireless Debugging is unexpectedly turned on, have the device inspected.

• Prefer app-based approvals or passkeys over SMS codes for banking, and review account activity regularly.

• Manage corporate Android devices with MDM and protect them with a Mobile Threat Defense (MTD) solution.

For more information, contact our experts at info@zerosecond.ae.

Zero Second | Zero News – Weekly cybersecurity briefing.

Zero News, prepared by Zero Second.