RatHat Console Uses Gemini to Rank Victims

Cleafy said RatHat's operators built and published the Android banking trojan from a web console, and that it traced nearly 100 console deployments from April 2026. It said the pattern fit a malware-as-a-service model in which each customer ran a separate copy.

Cleafy said the malware on infected phones had changed little since late 2025, while the console had been replaced. It identified an earlier console called Fisher and three newer versions built from the same code: BlackCat Remote Control Management, Panda Workshop V5 and Panda Workshop V6.

Cleafy said the console could build the app, hide it inside another app, sign it and publish it to Amazon S3 or a web server. It also said the console could rebuild the app on a schedule so that each file had a different hash, and that the latest version added fake download-page templates, including one called Google Store.

Cleafy said the malware reached a shell through Accessibility access, wireless debugging and Android Debug Bridge, and that the console could use that shell with one click. It said a deployed Go program used reverse tunnels and tools called minicap and minitouch for screen control, while Zimperium said the app also came through text messages and online ads.

Cleafy said the latest console version used Gemini only for estimating which victims were worth an operator's time, and that it did not use the model to move money. It also said the phone-side malware called Gemini when its own tap instructions did not match the device, and noted that ESET had described PromptSpy using Gemini in a similar way.