The new RatHat malware spreads via SMS, fake advertising, and online phishing, requiring users to manually install an APK file outside of the official Google Play store. Its primary goal is to steal banking information, one-time passwords (OTPs), and cryptocurrency access. By abusing accessibility services, the Trojan automatically turns on developer options and over-the-air debugging. This provides itself with a local, elevated shell without the need for a physical connection to the computer, reminiscent of the approach of the well-known ToxicPanda and RedHook malware families.<\/p>\n\n\n\n
After gaining ADB access, the Trojan installs a contained Go service called liblocal-service.so. This bypasses battery consumption limits and ensures system durability by protecting and reinstalling itself with the main program. Another component, libmedia_codec.so, acts as a reverse-proxy FRP client and establishes a permanent connection to the attackers\u2019 servers. To steal data, the Trojan displays HTML overlays to intercept online banking logins, reads SMS messages, notifications, PIN codes, screen lock patterns, and even web addresses from the browser.<\/p>\n\n\n\n
The main feature of the Trojan is the use of artificial intelligence to manage the user interface. The system converts the screen structure into XML format and sends it to a remote artificial assistant. The assistant accurately recognizes the coordinates of the buttons, reads the text and automatically executes commands such as scrolling down. This makes the operation much more flexible and less detectable than old scripts with fixed coordinates. When attempting to manually remove it, the Trojan intercepts the confirmation window, cancels the process and displays a fake Google Play Store error message. <\/p>\n\n\n\n
The basic protection against new malicious code remains unchanged: avoiding unverified APK files and using Google Play Protect.<\/p>","protected":false},"excerpt":{"rendered":"
Novi \u0161kodljivi program RatHat se \u0161iri prek SMS-sporo\u010dil, la\u017enega ogla\u0161evanja ter ribarjenja na spletu, pri \u010demer od uporabnikov zahteva ro\u010dno namestitev datoteke APK zunaj uradne trgovine Google Play. Njegov primarni cilj je kraja ban\u010dnih podatkov, enkratnih gesel OTP in dostopov do kriptovalut. Z zlorabo storitev dostopnosti trojanec samodejno vklopi razvijalske mo\u017enosti ter brez\u017ei\u010dno odpravljanje napak. […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[52,76],"tags":[478,482],"class_list":["post-8183","post","type-post","status-publish","format-standard","hentry","category-telefoni","category-varnost","tag-informacijska-varnost","tag-kibernetska-varnost"],"acf":{"subtitle":"","heading":"","summary":"Trojanec RatHat z umetno inteligenco samodejno upravlja oku\u017eene telefone Android ter krade ban\u010dne podatke in varnostne kode. \u0160iri se prek nepreverjenih datotek APK ter izrablja sistemska dovoljenja za popoln nadzor nad napravo.","thumbnail_small":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2020\/09\/280920_alienmalware-560x315.jpg","thumbnail_large":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2020\/09\/280920_alienmalware.jpg","thumbnail_caption":"Na va\u0161o mobilno napravo Android vedno name\u0161\u010dajte zgolj aplikacije, ki jih potrebujete in zgolj iz uradnih mest.","gallery":"","video_gallery":null,"author":"","links":null,"sources":null,"skip_language":[]},"yoast_head":"\n