RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

T2Covered by 1 source · first reported by The Hacker News at 28 Sept, 17:38 UTC

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer…

consumersecurity

Sources

• T2RatHat Android Malware Console Uses Gemini to Identify Higher-Value VictimsThe Hacker News28 Sept, 17:38