RatHat Android malware uses Gemini AI to target victims

Operators of the RatHat Android banking malware are using a web console that employs Google's Gemini AI model to estimate victims' bank balances from stolen SMS messages. This allows attackers to rank infected devices by potential value, prioritizing which victims to target. The attack infrastructure, including its command-and-control panel, has rapidly evolved and supports a malware-as-a-service model, facilitating hundreds of deployments and parallel campaigns across multiple regions.

• Gemini AI used to estimate and rank victim bank balances
• Console can build and deploy new Android malware samples
• Nearly 100 console deployments observed since April 2026
• RatHat infrastructure follows a malware-as-a-service model
• Panel updates include 2FA, phishing builder, role-based access