{"id":244166,"date":"2026-09-18T02:16:00","date_gmt":"2026-09-18T07:16:00","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/new-rathat-android-malware-uses-ai-to-automate-device-control"},"modified":"2026-09-18T02:16:00","modified_gmt":"2026-09-18T07:16:00","slug":"new-rathat-android-malware-uses-ai-to-automate-device-control","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/new-rathat-android-malware-uses-ai-to-automate-device-control","title":{"rendered":"New RatHat Android malware uses AI to automate device control"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/new-rathat-android-malware-uses-ai-to-automate-device-control.jpg\"><\/a><\/p>\n<p>A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.<\/p>\n<p>Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese.<\/p>\n<p>The researchers say the malware is distributed through malvertising, SMS, and phishing sites promoting APK downloads from outside Google Play.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. Zimperium zLabs researchers analyzed the malware and believe it is linked to threat actors from China after finding it using LLM prompts written in Chinese. The researchers say the malware is distributed through [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,1512,6],"tags":[],"class_list":["post-244166","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-mobile-phones","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244166"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244166\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}