RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

Security company Cleafy has been tracking the RatHat Android banking trojan, which is controlled by its operators through a web console. The console is used to manage infected phones and store collected data. Cleafy has identified nearly 100 deployments of this console since April 2026, indicating a malware-as-a-service model where each customer operates a separate instance. This model allows multiple customers to use the malware, with each running their own copy. The collected data from infected phones is stored in the console, potentially helping to identify higher-value targets.