Ankura CTIX FLASH Update – September 18, 2026

Malware Activity

RatHat Android Malware Uses GenAI to Automate Credential and Banking Theft

Security researchers at Zimperium have uncovered a new Android malware strain they’ve named RedHat linked to threat actors believed to be operating from China that targets banking credentials, 2FA and OTP codes, notifications, and other sensitive data while providing persistent remote access to compromised devices. RatHat is distributed through smishing, malvertising, malicious websites, and third-party forums, where victims are tricked into installing malicious APKs disguised as legitimate applications. A dropper abuses Android SessionInstaller APIs to bypass restricted settings and Accessibility Service protections, while multiple anti-analysis and anti-debugging layers hinder detection. The malware uses a three-part architecture consisting of a malicious Android application, a Go-based command-and-control agent, and an FRP client that creates a persistent reverse tunnel to the attacker