The banking trojan RATHat is now using Google Gemini to help infect and control Android smartphones. According to researchers from Cleafy, the large language model assists the malware in navigating unfamiliar device interfaces while also helping operators identify financially attractive victims.
Infection begins when the trojan masquerades as a legitimate application and persuades the user to enable Accessibility services. With these permissions, RATHat automatically turns on wireless debugging and connects to the device over ADB. The operator can then deploy a separate Go-based service that runs with system-level rights.
Simply uninstalling the original APK does not remove the threat. The Go service continues to operate independently, remains active until the next reboot, and can reinstall the dropped payload when needed.
Gemini reduces the amount of manual configuration required by analyzing the current screen layout and recommending the correct UI elements when standard tap sequences fail. This capability allows the malware to adapt across different Android versions, languages, and custom manufacturer skins with minimal operator intervention.
On the attacker side, the same model processes intercepted SMS messages, assesses bank account balances, and helps prioritize devices according to their potential financial value. Cleafy has tracked nearly 100 separate deployments of the command-and-control infrastructure since April, leading researchers to suspect a malware-as-a-service offering.
