Android malware reads passwords and bank PINs
Security researchers are warning about a new version of an Android malware called RatHat that steals banking logins, passwords and PINs. It was analysed by the mobile security company Zimperium. The malware disguises itself as a normal app and targets people who use banking and payment apps on their phones.
RatHat spreads mainly through links in text messages (SMS phishing), fake adverts and download sites outside the Google Play Store. Victims are tricked into installing an APK file. Once installed, the app pushes users to switch on Android's accessibility service, for example with a fake "network restriction" message. With that access, it can turn on developer settings by itself and give itself more rights on the phone.
The malware places fake login screens over real banking and payment apps, so users think they are logging in normally while their details go to the attackers. It can also read text messages and notifications, which lets it catch one-time codes used for two-factor authentication. According to Zimperium, it can even work out PINs and unlock patterns from where your finger touches the screen. It uses AI to find buttons and menus on the screen.
RatHat is hard to remove. It can show a fake error message when you try to uninstall it, and in tests a hidden service reinstalled it even after the app was deleted.
What to do: only install apps from the Google Play Store and never open app download links sent by SMS or messaging apps. Do not give accessibility access to an app unless you are sure what it is. If you installed a suspicious app from outside the Play Store, delete it, install all Android and Google Play system updates, and check your phone with a security app. If problems continue, reset the phone to factory settings. If you entered banking details on a possibly infected phone, call your bank through its official number, block your online banking access, and change your passwords from a different, clean device.