RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy.
The console stores what the malware collects from each phone,
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Angry
0
Sad
0
Wow
0
Raghib Awan
Raghib Awan is an Information Security and Technology professional with expertise spanning cybersecurity, cloud security, IT infrastructure, information risk, regulatory compliance, and enterprise security. He is also an author at TeQManch, a technology and cybersecurity news platform covering cyber threats, artificial intelligence, BFSI technology, data privacy, digital risk, and emerging technology trends.
![[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIhyphenhyphenHu3P6G99-W2G5NryBVw_aHrwdzZeMvGjoMkyUiKFOtwD_fqUvdytUAQuhg9gPZzpsWSFatNS2LcMylaW4jsMmRR-tmAXkZxokH4WcEqnXTlFnBFgg8-20j4LsTCQMaKRJY-ysNuH8uXg_D3Zb626eqIdGeTkkmvyh95PERJ_mnaPNnnv2maV0q4F2-/s1600/silverfort.jpg?#)
