Company
Zimperium is a mobile security company whose zLabs research team tracks and analyzes mobile malware, banking trojans, and Android/iOS threats.
RatHat's malware console now feeds stolen texts to Google's Gemini to estimate each victim's bank balance and rank who to rob first, security firm Cleafy says. Cleafy has traced nearly 100 deployments since April 2026 and found nothing that moves money.
Reality
Zimperium says the Android banking Trojan now abuses Accessibility to switch on wireless debugging and run commands through the ADB daemon. The target list is the smaller half of the story.
Perspective Coverage
6 publishersReality
Zimperium's September 9 write-up describes an Indonesian-linked family that encrypts files and streams the screen at once, resolves its command server through a GitHub repository, and loses most of its encryption reach on Android 10.
Reality
Zimperium says RatHat uses an accessibility grant to switch on Wireless Debugging and read its own 6-digit pairing code, leaving native daemons at shell privilege that keep answering after the app is removed.
Perspective Coverage
6 publishersReality
The Georgia Tech corpus says the handset belongs to the attacker while Regulation E says the loss belongs to the bank, which makes every extra authentication factor pushed to that same phone a purchase with no yield.
Reality
Island says the kit relays Microsoft 365 sign-ins behind genuine Docusign envelopes and legitimate Microsoft or Google redirects, leaving sender reputation nothing to grade.
Reality
Zimperium's 2026 heist report tracks 34 malware families against 1,243 financial brands. The capability mix has moved from stealing credentials to owning the handset and encrypting it.
Reality
ThreatFabric says the Android trojan hands collected data to nearby infected devices over Wi-Fi Direct or Bluetooth until one can reach command and control.
Reality