RatHat Android Banking Trojan Console Leverages Gemini AI for Victim Targeting

According to security firm Cleafy, the RatHat Android banking trojan console has been deployed nearly 100 times since April 2026. The operators build and publish the Android banking trojan, controlling infected phones through a web console that fits a malware-as-a-service model, where each customer runs a separate copy. The console stores what the malware collects from each phone. Cleafy's analysis indicates that Gemini AI is used to process collected data and prioritize high-value targets, a technique observed in recent malware campaigns. The firm traced the console infrastructure and noted that the malware collects sensitive data from infected Android devices globally. The report fits a growing trend of threat actors integrating large language model capabilities into malware infrastructure. Users are advised to avoid sideloading apps from untrusted sources and to keep Android security updates applied.