RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat's operators build and publish an Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026, fitting a malware-as-a-service model where each customer runs a separate copy. The console stores what the malware collects from each phone.