RatHat Android Banking Trojan Uses Gemini AI to Prioritize Victims

Mon, 28 Sep 2026 18:35:17 +0000

Engineer — Skip
SOC/IR — Learn: RatHat is an Android banking trojan MaaS with ~100 console deployments since April 2026; no IOCs or ATT&CK mappings are provided, but the AI-assisted victim prioritization technique is worth tracking as a detection research topic for mobile threat programs.
Leader — Learn: The AI-augmented victim triage capability in this MaaS model signals an escalating threat to retail banking and mobile-first enterprises; useful context for next board or risk-committee discussion on AI-enabled fraud trends.

Malware-as-a-Service on CuraSec