RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat is an Android banking trojan operating under a malware-as-a-service (MaaS) model, discovered and analyzed by security company Cleafy. The malware operators build and publish the Android banking trojan and manage infected devices through a web-based console. Cleafy has traced nearly 100 deployments of the console since April 2026, with each customer running a separate instance. The console stores data collected from compromised phones. A notable feature of the RatHat console is its integration with Google's Gemini AI to help operators identify higher-value victims among infected devices. This AI-assisted targeting represents an evolution in mobile banking malware sophistication, enabling more efficient and targeted financial fraud campaigns.